Eclipse ThreadX GUIX: Heap out-of-bounds write in PNG decoder
Summary
Eclipse ThreadX GUIX, a graphical framework for the ThreadX real-time OS, has a heap out-of-bounds write in its built-in PNG decoder. A PNG file with a second IHDR chunk after IDAT changes the image dimensions after the decoding buffer is allocated, so the row-filter pass writes past the end of that buffer. Exploitation requires that an application decodes the attacker's PNG file, and the software decoder is enabled by default. The CVSS 4.0 base score is 8.4 (High), and a memory write can crash the device or corrupt adjacent memory.
Affected
- Eclipse ThreadX GUIX from version 0 up to and including 6.5.1.202602a
- Default configuration, where the software decoder support is enabled (GX_SOFTWARE_DECODER_SUPPORT)
Fixed in
- Eclipse ThreadX GUIX 6.5.2.202603 (per the vendor advisory and the CVE record)
Workaround
- Do not decode PNG data from untrusted sources.
- In firmware builds where the software decoder is not needed, build with GX_DISABLE_SOFTWARE_DECODER_SUPPORT.
- Third-party suggestion, not from the vendor: reject PNG files with a second IHDR before decoding, or temporarily disable PNG decoding.
Exploitation
- No evidence of exploitation in the wild found. The CVE is not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- The reporter demonstrated the flaw with a 94-byte test file. No public exploit or write-up found. No exploit was developed and no code execution is claimed.
Our recommendation
- Ask device vendors whether their firmware embeds GUIX and which version.
- Request firmware updates that include GUIX 6.5.2.202603 or later.
- Check exposure: relevant only for devices such as HMI panels, appliances or IoT displays that process PNG files.
- Until patched, restrict PNG intake on affected devices to trusted sources and monitor for crashes or unexpected resets.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-gx8f-4rpc-4fjw (Eclipse ThreadX GUIX) github.com
- OpenCVE: CVE-2026-91186 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:16.
Original description (NVD)
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth *after* the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it. The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.