Description
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.
Published: 2026-10-15
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.
Title GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element
First Time appeared Gnome
Gnome libgxps
Weaknesses CWE-125
CPEs cpe:2.3:a:gnome:libgxps:*:*:*:*:*:*:*:*
Vendors & Products Gnome
Gnome libgxps
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Gnome Libgxps
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T18:57:27.144Z

Reserved: 2026-10-15T17:03:53.696Z

Link: CVE-2026-111132

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-15T19:17:26.810

Modified: 2026-10-15T19:17:26.810

Link: CVE-2026-111132

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses