Skip to content
OpenAdvisories
Medium · 6.1 CVE-2026-92454 EUVD-2026-105046

JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode

Published Oct 20, 2026 · Updated Oct 20, 2026 · Assigned by eclipse

Description

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.

Affected products

VendorProductAffectedFixed
Eclipse Foundation Eclipse ThreadX - GUIX ≤ 6.5.1.202602a 6.5.2.202603

References