CVE-2026-91186 Eclipse Foundation CVE debrief

Who should care

Defenders of systems using Eclipse ThreadX - GUIX, particularly those using versions 0 to 6.5.1.202602a, should assess exposure and verify if updates are available. The vulnerability can potentially lead to a crash or code execution, and defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

A vulnerability in the PNG decoder of Eclipse ThreadX - GUIX allows for a heap out-of-bounds write, potentially leading to a crash or code execution, affecting GUIX versions 0 to 6.5.1.202602a.

• Potential crash or code execution
• Heap out-of-bounds write possible
• Verification of GUIX version required
• Update to version 6.5.2.202603 or later recommended

Technical summary

The PNG chunk reader in Eclipse ThreadX - GUIX does not enforce chunk ordering, allowing a duplicate IHDR chunk after the IDAT chunk to resize the image after allocation, causing a heap out-of-bounds write. This can potentially lead to a crash or code execution. The vulnerability affects GUIX versions 0 to 6.5.1.202602a. Defenders should assess exposure and verify if updates are available. The issue arises from the PNG chunk reader's lack of enforcement of chunk ordering, allowing a duplicate IHDR chunk to resize the image after allocation.

Defensive priority

High

Recommended defensive actions

• Assess exposure of GUIX versions 0 to 6.5.1.202602a
• Verify if Eclipse ThreadX - GUIX is used in your environment
• Check for updates to GUIX version 6.5.2.202603 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The vulnerability is caused by the PNG chunk reader's lack of enforcement of chunk ordering. A duplicate IHDR chunk after the IDAT chunk can resize the image after allocation, causing a heap out-of-bounds write. Defenders should verify if Eclipse ThreadX - GUIX is used in their environment and check for updates to GUIX version 6.5.2.202603 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.