{"id":"CVE-2026-92454","published":"2026-10-20T15:17:36.757","lastModified":"2026-10-20T19:48:50.250","description":"The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.","cvssScore":6.1,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cwes":["CWE-125","CWE-835"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-threadx/guix/security/advisories/GHSA-pppm-h3g4-986x","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-threadx/guix/security/advisories/GHSA-pppm-h3g4-986x","tags":[]}],"hasPoc":true,"ai":null}