CVE-2026-91189

The GUIX binary resource loader never checks that a font page's glyph range is well formed. gx page header first glyph and gx page header last glyph are read verbatim from the file and only the upper bound of last glyph is validated, so a page declaring first glyph > last glyph makes last - first + 1 underflow to a very large unsigned count.

That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.