The GUIX binary resource loader fails to validate the glyph range defined in a font or theme file; when the page specifies a first_glyph value greater than last_glyph, the signed arithmetic lowers to a large unsigned count. Multiplying this count by the glyph record size overflows, yielding a buffer that is far too small for the data that follows. When the loader streams this data, it writes attacker-controlled glyph records past the end of the allocated buffer, corrupting heap memory. This memory corruption can be leveraged for arbitrary code execution or to crash the application, depending on the execution context.

The vulnerability affects Eclipse Foundation's ThreadX GUIX binary resource loader. No specific product versions are listed, so any release of Eclipse ThreadX containing GUIX with the unvalidated glyph range logic may be susceptible.

With a CVSS score of 7.1, the risk is moderate to high. No EPSS score is available, and the vulnerability is not listed in KISA's KEV catalog, suggesting limited public exploitation data. The attack requires an attacker to supply a malicious font or theme; thus the vector is inferred to involve local or remote file loading by the GUIX component. Successful exploitation would result in memory corruption on the host running the vulnerable GUIX instance.