CVE-2026-111132: Out-of-bounds Read in GNOME libgxps

GNOME libgxps versions up to 0.3.2 contain a heap out-of-bounds read vulnerability in the path_geometry_start_element() function. The flaw is triggered by a crafted XPS document containing PolyBezierSegment or PolyQuadraticBezierSegment elements with Points attributes whose point counts are not divisible by three or two, respectively. This allows an attacker to read past allocated memory on the heap, potentially causing application crashes and leaking adjacent heap memory contents during rendering. The vulnerability affects applications that consume libgxps, such as Evince.

An attacker can cause a denial of service by crashing applications that use libgxps for XPS document rendering. Additionally, the out-of-bounds read may leak adjacent heap memory contents, which could expose sensitive information. There is no indication of remote code execution or privilege escalation. The attack requires user interaction (UI:P) and local access (AV:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted or suspicious XPS documents with applications using libgxps. Monitor vendor channels for updates and apply official patches once released.