Eclipse ThreadX GUIX: Heap out-of-bounds write in binary resource loader
Summary
The binary resource (theme) loader of Eclipse ThreadX GUIX sizes and fills a heap buffer in two passes that can disagree on glyph counts when a font resource is malformed. An attacker who supplies a crafted .bin resource file can write attacker-chosen data beyond the end of the buffer, which can corrupt memory. The flaw is present in the default configuration, where GX_BINARY_RESOURCE_SUPPORT is enabled, and requires that a device loads an untrusted resource file, for example from removable media or an OTA update. The reporter did not develop an exploit or demonstrate code execution.
Affected
- Eclipse Foundation GUIX up to and including 6.5.1.202602a
- Default configuration (GX_BINARY_RESOURCE_SUPPORT enabled)
Fixed in
- GUIX 6.5.2.202603 (per vendor; the fix ships in 6.5.x, no backport to 6.4.x)
Workaround
- Load binary resource files only from trusted sources.
- No build option disables the theme loader while keeping the rest of the binary resource API usable.
Exploitation
- No exploit developed by the reporter; no claim of code execution.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV. EPSS 0.0016.
Our recommendation
- Identify devices that embed Eclipse ThreadX GUIX with binary resource support.
- Update to GUIX 6.5.2.202603 or later, or request a firmware update from the device vendor.
- Restrict theme and resource file loading to trusted media and signed update channels.
- Monitor the vendor advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-m2f3-cv9x-68q7 github.com
- Eclipse CVE assignment work item #358 gitlab.eclipse.org
- VulDB entry 420261 vuldb.com
- Vulners VulnRichment CVE-2026-103414 vulners.com
- OpenCVE CVE-2026-103414 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:26.
Original description (NVD)
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.