Eclipse Threadx Guix
Monthly
Heap-based out-of-bounds write in the Eclipse ThreadX GUIX binary resource (font) loader: a font page header declaring first_glyph greater than last_glyph underflows the glyph count (CWE-190), the count-times-record-size allocation multiply then wraps to a small value, and the load pass writes attacker-controlled glyph records past the end of the undersized buffer. Exploitation requires the target embedded application to load an attacker-supplied or tampered GUIX binary font resource - the assessed vector is local (AV:L) with high attack complexity and required user/application interaction - so realistic exposure is limited to devices that parse externally sourced or updatable GUIX resources rather than fixed build-time font assets; no public exploit code or confirmed active exploitation was identified at time of analysis. Successful corruption can yield code execution, data disclosure, or denial of service in the GUIX process context (CVSS 4.0 base 7.1).
The Eclipse ThreadX GUIX PNG decoder can be driven out of bounds by a crafted PNG that places a second IHDR chunk after IDAT, enabling memory corruption in applications that render attacker-supplied images. Any integration with the GUIX PNG decoder enabled is in scope, since the decoder is compiled in by default, and exploitation is local and requires user/application interaction to open the crafted file. No public exploit was identified at time of analysis; the reporter rates the issue 8.4, and the independent assessment treats it as a local, user-interaction-dependent memory-corruption flaw.
Eclipse GUIX multi-line text view rendering can read one byte past the end of an application text buffer when the displayed string ends with a carriage return, and that over-read can cascade into an index overrun and a spurious text row. The issue is local and requires user interaction: an attacker must influence text rendered in a GUIX multi-line text view and a user must view that widget; impact is limited to low confidentiality and availability effects, with no public exploit identified at time of analysis. It is a low-to-moderate priority memory-safety bug in Eclipse ThreadX GUIX rather than a remotely triggerable or code-execution issue.
Truncated JPEG marker segments and a zero chroma sampling factor in Eclipse ThreadX GUIX's software JPEG decoder can trigger an out-of-bounds read and a non-terminating block-decode loop, letting a local, unauthenticated attacker who can get a crafted JPEG opened or rendered crash or hang the device and potentially disclose a small amount of adjacent memory. Both triggers reproduce in the default configuration with GX_SOFTWARE_DECODER_SUPPORT enabled; the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H), so the dominant outcome is availability loss rather than large-scale data theft. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided.
An out-of-bounds read in the Eclipse ThreadX GUIX JPEG software decoder lets a crafted JPEG file expose memory beyond an undersized image buffer. The flaw affects GUIX builds with GX_SOFTWARE_DECODER_SUPPORT enabled, which is the shipped default, and is triggered by a JPEG whose marker ordering is illegal - specifically a second SOF0 frame header placed after SOS - which re-parses the frame header after the output buffer has already been allocated and its geometry latched. The decoder then returns GX_SUCCESS and publishes a GX_PIXELMAP whose reported dimensions and data_size exceed the actual allocation, so any consumer trusting the structure, including GUIX's own display drivers via the ordinary draw path, reads past the buffer; interaction is required and the attack is local (the malicious file must reach the decoder), and no public exploit code has been identified at time of analysis.
Out-of-bounds reads in Eclipse ThreadX GUIX can expose adjacent memory or terminate the application when gx_binres_theme_load() or gx_binres_font_load() processes a crafted theme or font resource that declares more data than it contains or embeds an out-of-range offset. The loaders accept a bare resource pointer with no length, so file-controlled offsets can drive reads past the buffer end; a well-formed, narrow glyph range is sufficient, and no underflow or integer-wrap is required. Exploitation is local and requires the application to load an untrusted GUIX resource, and no public exploit or CISA KEV activity is identified at time of analysis.
Out-of-bounds write in the Eclipse ThreadX GUIX binary resource theme loader lets an attacker who supplies a crafted GUIX theme file corrupt the GUIX memory arena and potentially hijack execution or crash the device. The flaw is only reachable in products that call the public API gx_binres_theme_load() on externally supplied or user-replaceable theme files, with GX_BINARY_RESOURCE_SUPPORT compiled in (the shipped default). CVSS 4.0 rates this 6.8 (Medium) with a local attack vector and required user interaction; no public exploit code and no CISA KEV entry were identified at time of analysis.
Heap-based out-of-bounds write in the Eclipse ThreadX GUIX binary resource (font) loader: a font page header declaring first_glyph greater than last_glyph underflows the glyph count (CWE-190), the count-times-record-size allocation multiply then wraps to a small value, and the load pass writes attacker-controlled glyph records past the end of the undersized buffer. Exploitation requires the target embedded application to load an attacker-supplied or tampered GUIX binary font resource - the assessed vector is local (AV:L) with high attack complexity and required user/application interaction - so realistic exposure is limited to devices that parse externally sourced or updatable GUIX resources rather than fixed build-time font assets; no public exploit code or confirmed active exploitation was identified at time of analysis. Successful corruption can yield code execution, data disclosure, or denial of service in the GUIX process context (CVSS 4.0 base 7.1).
The Eclipse ThreadX GUIX PNG decoder can be driven out of bounds by a crafted PNG that places a second IHDR chunk after IDAT, enabling memory corruption in applications that render attacker-supplied images. Any integration with the GUIX PNG decoder enabled is in scope, since the decoder is compiled in by default, and exploitation is local and requires user/application interaction to open the crafted file. No public exploit was identified at time of analysis; the reporter rates the issue 8.4, and the independent assessment treats it as a local, user-interaction-dependent memory-corruption flaw.
Eclipse GUIX multi-line text view rendering can read one byte past the end of an application text buffer when the displayed string ends with a carriage return, and that over-read can cascade into an index overrun and a spurious text row. The issue is local and requires user interaction: an attacker must influence text rendered in a GUIX multi-line text view and a user must view that widget; impact is limited to low confidentiality and availability effects, with no public exploit identified at time of analysis. It is a low-to-moderate priority memory-safety bug in Eclipse ThreadX GUIX rather than a remotely triggerable or code-execution issue.
Truncated JPEG marker segments and a zero chroma sampling factor in Eclipse ThreadX GUIX's software JPEG decoder can trigger an out-of-bounds read and a non-terminating block-decode loop, letting a local, unauthenticated attacker who can get a crafted JPEG opened or rendered crash or hang the device and potentially disclose a small amount of adjacent memory. Both triggers reproduce in the default configuration with GX_SOFTWARE_DECODER_SUPPORT enabled; the CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H), so the dominant outcome is availability loss rather than large-scale data theft. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was provided.
An out-of-bounds read in the Eclipse ThreadX GUIX JPEG software decoder lets a crafted JPEG file expose memory beyond an undersized image buffer. The flaw affects GUIX builds with GX_SOFTWARE_DECODER_SUPPORT enabled, which is the shipped default, and is triggered by a JPEG whose marker ordering is illegal - specifically a second SOF0 frame header placed after SOS - which re-parses the frame header after the output buffer has already been allocated and its geometry latched. The decoder then returns GX_SUCCESS and publishes a GX_PIXELMAP whose reported dimensions and data_size exceed the actual allocation, so any consumer trusting the structure, including GUIX's own display drivers via the ordinary draw path, reads past the buffer; interaction is required and the attack is local (the malicious file must reach the decoder), and no public exploit code has been identified at time of analysis.
Out-of-bounds reads in Eclipse ThreadX GUIX can expose adjacent memory or terminate the application when gx_binres_theme_load() or gx_binres_font_load() processes a crafted theme or font resource that declares more data than it contains or embeds an out-of-range offset. The loaders accept a bare resource pointer with no length, so file-controlled offsets can drive reads past the buffer end; a well-formed, narrow glyph range is sufficient, and no underflow or integer-wrap is required. Exploitation is local and requires the application to load an untrusted GUIX resource, and no public exploit or CISA KEV activity is identified at time of analysis.
Out-of-bounds write in the Eclipse ThreadX GUIX binary resource theme loader lets an attacker who supplies a crafted GUIX theme file corrupt the GUIX memory arena and potentially hijack execution or crash the device. The flaw is only reachable in products that call the public API gx_binres_theme_load() on externally supplied or user-replaceable theme files, with GX_BINARY_RESOURCE_SUPPORT compiled in (the shipped default). CVSS 4.0 rates this 6.8 (Medium) with a local attack vector and required user interaction; no public exploit code and no CISA KEV entry were identified at time of analysis.