The GUIX binary resource loader reads font data in two passes but fails to validate the glyph data size against the actual page contents. This mismatch causes an out‑of‑bounds write that overflows the internal memory arena and corrupts adjacent memory. The likely attack vector involves an attacker supplying a crafted resource file, which could lead to arbitrary code execution or destabilization of the application.

The vulnerability affects all Eclipse Foundation GUIX products where GX_BINARY_RESOURCE_SUPPORT is enabled, which is the default configuration. No specific version delimiters are provided, but any build shipped with the default theme loading feature is potentially affected.

The CVSS score of 8.4 indicates high severity, and the EPSS score is not available, suggesting that large‑scale exploitation has not yet been observed. It is inferred that attackers would need access to the binary resource files or a way to influence the GUIX theme loading process, implying a local or potentially remote threat depending on how the application is exposed. The lack of input size parameters means there is no straightforward harness for remote exploitation without additional context.