CVE-2026-92449

gx binres pixelmap table load() in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.

The overflowed buffer is allocated by GUIX itself, through gx system memory allocator, rather than supplied by the caller, so the loader corrupts its own arena. The public API gx binres theme load() takes no size parameter, so no amount of caller diligence prevents this.

Reproduces in the shipped default configuration; GX BINARY RESOURCE SUPPORT is enabled by default.