CVE-2026-91059
2026-10-20
15h17 +00:00
15h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it.
Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path.
Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Out-of-bounds Read The product reads data past the end, or before the beginning, of the intended buffer. |
