Skip to content
OpenAdvisories
Medium · 4.6 CVE-2026-91057 EUVD-2026-105126

Out-of-bounds read when a multi-line text view string ends with a carriage return

Published Oct 20, 2026 · Updated Oct 20, 2026 · Assigned by eclipse

Description

`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in `_gx_multi_line_text_view_string_total_rows_compute()` and a row of text that is not in the source.

Affected products

VendorProductAffectedFixed
Eclipse Foundation Eclipse ThreadX - GUIX ≤ 6.5.1.202602a 6.5.2.202603

References