CVE-2026-92454 — JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode

CVE-2026-92454

JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode PUBLISHED

Description (CNA)

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.

Affected (CNA)

Vendor / product	Versions
Eclipse Foundation / Eclipse ThreadX - GUIX	affected 0 through 6.5.1.202602a; unaffected 6.5.2.202603

CWE

CWE-125, CWE-835

References

https://github.com/eclipse-threadx/guix/security/advisories/GHSA-pppm-h3g4-986x

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.