Key points
- CVE-2026-91186 enables out-of-bounds reads via duplicate PNG headers in Eclipse GUIX.
- The vulnerability affects versions up to 6.5.1.202602a and is compiled in by default.
- Attackers can exploit the lack of chunk ordering checks to overwrite image dimensions.
The Eclipse Foundation GUIX graphical library contains a high-severity vulnerability that allows malicious PNG files to trigger out-of-bounds memory access. This flaw, tracked as CVE-2026-91186 with a CVSS score of 8.4, stems from how the decoder processes chunk ordering within image files.
The PNG specification requires exactly one IHDR chunk at the start of a file, defining width, height, and bit depth. However, the GUIX reader does not enforce this ordering strictly. It tracks whether an IDAT chunk has been seen and if transparency data is present, but it permits a second IHDR chunk to be processed later in the file stream.
Technical Mechanics
When a second IHDR chunk appears after the initial IDAT data, it overwrites the image’s width, height, bit depth, and pixel depth. This occurs after the decoder has already allocated and filled a data buffer based on the original dimensions. The subsequent pass, which reverses PNG row filters, uses the new, potentially larger dimensions to calculate its extent.
Because the decoder walks the old allocation using the new dimensions, it moves image bytes past the end of the allocated buffer. This results in an out-of-bounds read. The buffer is allocated internally by GUIX rather than being supplied by the caller, meaning the application cannot defensively size it to prevent this overflow.
Affected Software
This vulnerability impacts the Eclipse Foundation Eclipse ThreadX - GUIX library. Specifically, versions up to and including 6.5.1.202602a are affected. The decoder component containing this flaw is compiled into the library by default, meaning most standard builds will include the vulnerable code without additional configuration or enabling flags.
Next steps
No patch or fix has been confirmed yet by the vendor. Security teams should assume that any deployment using GUIX versions up to 6.5.1.202602a is exposed to this issue. Since the flaw is in the default build, simply having the library linked is sufficient for exposure.
Signals worth monitoring
Teams usually look for unexpected memory access violations in application logs when handling image files. Check whether your image processing services are generating segmentation faults or access violations when parsing user-supplied PNGs. Monitor for anomalous behavior in graphical user interfaces that might freeze or crash after loading specific images. If you see repeated crashes tied to image loading, isolate the input files for analysis. Do not assume all PNGs are safe; verify that your parsers reject malformed or non-standard chunk orders.
What to do and how to stay safe: CVE-2026-91186
- Audit your software inventory to identify any use of Eclipse GUIX versions up to 6.5.1.202602a.
- Restrict untrusted image input to your applications until a vendor update is released.
- Monitor application logs for memory access errors or crashes triggered by PNG processing.
- Implement strict input validation to reject PNG files with duplicate IHDR chunks if possible.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-91186?
The CVSS score is 8.4, which is rated as HIGH severity.
Which versions of GUIX are affected?
Versions up to and including 6.5.1.202602a of Eclipse ThreadX - GUIX are affected.
Is there a patch available for this vulnerability?
No patch or fix has been confirmed yet by the vendor.
