CVE-2026-111132
Received Received - Intake

Heap Out-of-Bounds Read in GNOME libgxps

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-111132
EUVD
EUVD-2026-102259

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
GNOME libgxps 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds read in GNOME libgxps through version 0.3.2. It occurs when processing crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes in XPS documents. Attackers exploit it by providing a point count not divisible by three or two, causing applications to read past allocated memory. This can crash consumers like Evince and expose adjacent heap memory in output.

Detection Guidance

Detecting this vulnerability requires inspecting XPS documents processed by libgxps. Check if your system uses vulnerable versions of libgxps (0.3.2 or earlier) by running commands like 'dpkg -l | grep libgxps' on Debian-based systems or 'rpm -qa | grep libgxps' on RPM-based systems. Monitor applications like Evince for crashes when opening XPS files.

Impact Analysis

This vulnerability can crash applications like Evince that use libgxps to render XPS/OXPS documents. It may also expose sensitive heap memory in the output, potentially leaking data. Users opening maliciously crafted XPS files could experience crashes or unintended information disclosure.

Mitigation Strategies

Update libgxps to the latest version if available. Avoid opening untrusted XPS documents. If using GNOME document viewers, consider switching to alternative viewers until patched. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111132. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart