CVE-2026-92454: CWE-125 Out-of-bounds Read in Eclipse Foundation Eclipse ThreadX - GUIX

The vulnerability in Eclipse ThreadX - GUIX's JPEG decoder arises because it reads four types of marker segments without validating that each segment is sufficiently long to safely read the expected data. This results in an out-of-bounds read past the end of the caller's image buffer (CWE-125). Separately, if a zero chroma sampling factor is present, the block decode loop does not terminate properly (CWE-835). Both issues are reproducible in the default software decoder configuration (GX_SOFTWARE_DECODER_SUPPORT enabled).

The out-of-bounds read can lead to reading memory beyond the intended buffer, potentially causing application crashes or denial of service. The non-terminating decode loop caused by a zero chroma sampling factor can also result in denial of service by causing the decoder to hang. The CVSS 3.1 score is 6.1 (medium), reflecting local attack vector, low complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling GX_SOFTWARE_DECODER_SUPPORT if feasible or apply other vendor-recommended mitigations once published.