CVE-2026-91186: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX - GUIX

The vulnerability in Eclipse ThreadX - GUIX's PNG chunk reader stems from improper handling of PNG chunk ordering. Specifically, the reader allows a second IHDR chunk to be read after the IDAT chunk, which is against the PNG specification that mandates a single IHDR chunk at the start. When this occurs, the image width, height, bit depth, and pixel depth are overwritten after the decoded data buffer has been allocated and filled based on the original IHDR values. Consequently, the filter reversal pass calculates extents based on the new dimensions but operates on the old buffer allocation, causing out-of-bounds reads. Since GUIX allocates the buffer internally, applications cannot preemptively allocate larger buffers to prevent this issue. The vulnerability is present in versions >=0 and <=6.5.1.202602a.

An attacker can craft a malicious PNG file with a second IHDR chunk placed after the IDAT chunk, causing the PNG decoder to perform out-of-bounds reads during image processing. This can lead to memory corruption, potentially resulting in application crashes or information disclosure. The vulnerability requires local access (AV:L) and user interaction (UI:A) but does not require privileges or authentication. The CVSS 4.0 score is 8.4 (high), reflecting the significant impact on confidentiality, integrity, and availability.

No official patch or fix is currently confirmed for this vulnerability. Since the buffer allocation is internal to GUIX and the decoder is compiled in by default, applications cannot mitigate this by defensive buffer sizing. Users should monitor the Eclipse Foundation's advisories for an official fix. Until then, avoid processing untrusted PNG files with affected versions of Eclipse ThreadX - GUIX.