CVE-2026-102729: eclipse foundation guix Incorrect Calculation of Buffer Size

Vulnerability summary

CVE-2026-102729 is a medium (CVSS 5.9) Incorrect Calculation of Buffer Size vulnerability in eclipse foundation guix. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.5% of scored vulnerabilities.

Timeline

1. 29-09-2026
   PublishedVulnerability first disclosed.
2. 29-09-2026
   Last modifiedVulnerability information updated.

Description

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

• CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.