CVE-2026-91189: CWE-190 Integer Overflow or Wraparound in Eclipse Foundation Eclipse ThreadX - GUIX

The vulnerability arises because the GUIX binary resource loader reads `gx_page_header_first_glyph` and `gx_page_header_last_glyph` from a font page without verifying that `first_glyph` is less than or equal to `last_glyph`. If `first_glyph` is greater, the calculation `last - first + 1` underflows to a large unsigned number. This count is then multiplied by the glyph record size without overflow checks, causing the multiplication to wrap to a smaller value. Consequently, the loader allocates a buffer that is too small for the actual data. Later, the loader writes attacker-controlled glyph records into this undersized buffer, resulting in a buffer overflow condition.

An attacker can craft a malicious font page with an invalid glyph range to trigger an integer overflow and buffer overflow in the GUIX loader. This can lead to memory corruption, potentially causing application crashes or enabling code execution with the privileges of the affected process. The vulnerability requires local access (AV:L) and high attack complexity (AC:H), with no privileges required (PR:N) but user interaction needed (UI:A). The impact on confidentiality, integrity, and availability is high.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid loading untrusted or malformed font resources with the GUIX binary resource loader component.