CVE-2026-91059: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX - GUIX

The GUIX JPEG software decoder in Eclipse ThreadX - GUIX does not enforce ordering on JPEG markers. When a JPEG file places a second SOF0 frame header after the SOS marker, the decoder re-parses the frame header after the output buffer has been allocated and its geometry fixed. Despite this, the decoder returns success and provides a GX_PIXELMAP with dimensions and data size exceeding the actual allocated buffer size. This discrepancy causes out-of-bounds reads by any consumer trusting the pixel map, including internal display drivers. The vulnerability is reproducible in the default shipped configuration with GX_SOFTWARE_DECODER_SUPPORT enabled.

An attacker can craft a specially malformed JPEG file that triggers out-of-bounds reads in the GUIX JPEG decoder. This may lead to reading memory beyond allocated buffers, potentially causing application crashes or exposing sensitive memory contents. The vulnerability affects any component that consumes the returned GX_PIXELMAP structure, including GUIX's display drivers. The CVSS 4.0 base score is 6.8 (medium severity), reflecting local attack vector, low complexity, no privileges required, user interaction needed, and high impact on confidentiality.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling GX_SOFTWARE_DECODER_SUPPORT if feasible or implement input validation to reject JPEG files with multiple SOF0 markers after SOS. Monitor vendor communications for updates and apply official patches once released.