Eclipse ThreadX GUIX EUVD-2026-89200

Exploitation requires the GUIX application to load an attacker-supplied or attacker-modified binary theme resource whose requested theme id is at or beyond the theme count declared by that resource; gx_binres_theme_load() then allocates a zero-byte buffer and writes a GX_THEME structure past the theme table. Limiting factors: the attack vector is local (AV:L) - the attacker must place or substitute the malicious resource file - and it requires user/application interaction (UI:P) to actually load that resource, plus the specific out-of-range-id attack condition (AT:P). It does not affect default operation unless a crafted resource is loaded, and there is no remote unauthenticated network path.

This is a genuine memory-corruption bug (CWE-131 incorrect buffer-size calculation leading to a heap out-of-bounds write) in Eclipse ThreadX GUIX, but the real-world risk is moderate rather than high. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:P) scores it 5.9 medium, and the signals are internally consistent: the vulnerability is local (AV:L), requires a specific attack condition (AT:P - the resource must contain an out-of-range theme id), and needs user/application interaction (UI:P) to load the malicious binary resource. Impact skews to integrity and availability (VI:H/VA:H) with only limited confidentiality exposure (VC:L), consistent with a controlled heap write that corrupts adjacent structures rather than leaking data. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so there is no evidence of active exploitation - the primary risk driver is the wide embedded footprint of GUIX, not ease of remote attack. Note one metadata conflict: the CVE is tagged 'Information Disclosure' while the CVSS vector clearly indicates a write-corruption bug (VI:H/VA:H, VC:L) - the impact is memory corruption, not primarily disclosure. Priority is medium: legitimate flaw in ubiquitous embedded software, but exploitation requires local delivery of a crafted resource and user interaction.

An attacker crafts a malicious GUIX binary resource (theme) file in which a requested theme id sits at or beyond the theme count declared by the resource. When a GUIX application loads this resource via gx_binres_theme_load(), a zero-byte buffer is allocated and the loader writes a full GX_THEME structure and its tables into it, corrupting the heap and potentially enabling code execution or a crash. No public proof-of-concept is known; exploitation requires local delivery of the resource file and the application loading it.