Heap Out-of-Bounds Read in GNOME libgxps Affects Document Consumers
CVE-2026-111132
6.9MEDIUM
What is CVE-2026-111132?
The GNOME libgxps library, up to version 0.3.2, suffers from a heap out-of-bounds read vulnerability within the path_geometry_start_element() function. This issue arises when an attacker manipulates the point count of PolyBezierSegment or PolyQuadraticBezierSegment attributes in a specially crafted XPS document. By providing a point count that is not properly divisible by three or two, attackers can exploit this vulnerability, potentially causing consumers, such as Evince, to crash and exposing adjacent heap memory to the output. This flaw underlines the importance of validating input counts in graphics document handling.
Affected Version(s)
libgxps 0 <= 0.3.2
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology