The vulnerability is an out‑of‑bounds read in the GUIX binary resource loader functions, which consume a byte buffer without an accompanying length field. A resource file that claims to contain more data than it actually does causes the loader to read past the end of the buffer, turning an unchecked file offset into a pointer. This leads to memory disclosure of arbitrary data in the process's address space and could potentially be leveraged to corrupt memory. The weakness is classified as CWE-125.

Eclipse Foundation’s Eclipse ThreadX – GUIX is the affected product. No specific version information is supplied, so any released build that includes the buggy loader routines is potentially susceptible.

The CVSS score of 6.8 places the issue in the medium severity range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly stated, but it is likely to be triggered by an untrusted resource file processed by the GUIX loader. If an attacker can supply a crafted file to the GUIX component, they could read sensitive memory, which may enable further compromise. The lack of a publicly listed exploit path suggests the risk of exploitation is currently low, but the potential impact remains significant if the memory read can be chained to other weaknesses.