PT-2026-118410 · Eclipse Foundation · Eclipse Threadx - Guix
CVSS v4.0
7.1
Alta
| Vetor | AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
The GUIX binary resource loader never checks that a font page's glyph range is well formed.
gx page header first glyph and gx page header last glyph are read verbatim from the file and only the upper bound of last glyph is validated, so a page declaring first glyph > last glyph makes last - first + 1 underflow to a very large unsigned count.That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
Correção
Memory Corruption
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Eclipse Threadx - Guix