CVE-2026-92454 — JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the…
Published: 2026-10-20 · CVSS: 6.8 · CVSS 4.0
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7