CVE-2026-91059

What it is

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it. Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path. Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.

At a glance

Exploitability

Can be exploited locally on the machine without logging in, but needs a user to act. High risk of data exposure.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-10-20 15:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-20 19:48 UTC Last updatedMost recent change to the record

Details

Published

2026-10-20 15:17 UTC

Last modified

2026-10-20 19:48 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-125 · Out-of-bounds read

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 6.8

Attack vector

Local

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

Active

Confidentiality

High

Integrity

None

Availability

Low