CVE-2026-111132: GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in pathgeometrystartelement() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use GNOME libgxps to process XPS documents are exposed, including consumers such as Evince. The affected libgxps versions are through 0.3.2.
What does exploitation require?
An attacker needs to get a user or application to process a crafted XPS document containing a PolyBezierSegment or PolyQuadraticBezierSegment Points attribute with an invalid point count. The supplied point count must not be divisible by three for PolyBezierSegment or by two for PolyQuadraticBezierSegment.
What is the likely impact when a malicious document is processed?
Processing can read beyond a heap allocation, which can crash the consuming application. Adjacent heap memory may also be rendered into output, creating a potential information disclosure.