CVE-2026-111132

MediumCVSS 6.1

Published: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows reading past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. An attacker can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.

Risk Assessment

An attacker can crash applications viewing XPS documents (denial of service) or leak heap memory data into rendered output. The risk affects systems displaying untrusted XPS documents.

Recommendation

Update libgxps to a patched version and avoid opening untrusted XPS documents until the fix is applied. Monitor applications such as Evince for unexpected crashes.

Other vulnerabilities in libgxps

CVE-2017-11590High
There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service attack.

Original NVD description (English source)

GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS