CVE-2026-92446 Eclipse Foundation CVE debrief

Who should care

Defenders responsible for systems using Eclipse ThreadX - GUIX should assess their exposure and verify the versions in use. This vulnerability may impact systems that utilize the affected versions of Eclipse ThreadX - GUIX.

Why it matters

The Eclipse ThreadX - GUIX binary resource loader vulnerability allows for reading past the end of a resource, potentially leading to security issues. Defenders should prioritize verifying the versions in use and checking for malicious resources.

• Defenders need to verify the versions of Eclipse ThreadX - GUIX in use to ensure they are not vulnerable.
• Checking for any resources that may have been crafted with malicious offsets is crucial.
• Implementing bounds checking for resource lengths can help prevent similar vulnerabilities in the future.

Technical summary

The `gx_binres_theme_load()` and `gx_binres_font_load()` functions in Eclipse ThreadX - GUIX take a resource as a bare `GX_UBYTE *` with no length, leading to a situation where a resource that declares more data than it contains can be read past its end. This occurs because the `GX_BINRES_DATA_INFO` structure has no field to carry the length of the resource, and every read operation is performed at an offset chosen by the file itself against a buffer whose extent the loader does not know.

Defensive priority

Defenders should prioritize verifying the versions of Eclipse ThreadX - GUIX in use and checking for any resources that may have been crafted with malicious offsets.

Recommended defensive actions

• Verify the version of Eclipse ThreadX - GUIX in use and ensure it is 6.5.2.202603 or later.
• Check for any resources that may have been crafted with malicious offsets.
• Implement bounds checking for resource lengths.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE Program record and the NVD vulnerability detail page provide official information about the vulnerability. The source item from cve_program_cvelist_v5 and the supplemental source reference from GitHub also support the details of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.