`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded.
This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.
CVSS
No CVSS.
References
Configurations
No configuration.
History
20 Oct 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-20 15:17
Updated : 2026-10-20 19:48
NVD link : CVE-2026-92446
Mitre link : CVE-2026-92446
CVE.ORG link : CVE-2026-92446
JSON object : View
Products Affected
No product.
CWE
CWE-125
Out-of-bounds Read