CVE-2026-92449: CWE-129 Improper Validation of Array Index in Eclipse Foundation Eclipse ThreadX - GUIX

The vulnerability in Eclipse ThreadX - GUIX involves improper validation of an array index in the _gx_binres_pixelmap_table_load() function. The function reads an index value directly from a binary resource file without bounds checking against the pixelmap table size, allowing a crafted theme resource to cause a buffer overflow of roughly 256 KB past the end of the allocated table. The buffer is allocated internally by GUIX's memory allocator, so the overflow corrupts the internal memory arena. The public API gx_binres_theme_load() does not accept a size parameter, preventing callers from mitigating this issue. This flaw affects versions >=6.3.0 and <=6.5.1.202602a and is present in the default configuration with GX_BINARY_RESOURCE_SUPPORT enabled.

Successful exploitation can lead to corruption of the GUIX internal memory arena, potentially causing application instability, crashes, or other unintended behavior. The CVSS 4.0 score is 6.8 (medium), reflecting local attack vector with low complexity, no privileges required, but requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability with high impact on integrity and availability.

No official patch or fix is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is due to improper bounds checking in the resource loader and the public API does not allow size validation, mitigation options are limited. Users should monitor vendor communications for patches or updates. Until a fix is available, avoid loading untrusted or crafted theme binary resources that could trigger the overflow.