GNOME libgxps CVE-2026-111132

Exploitation requires a victim to open or render an attacker-crafted XPS document in a libgxps-based consumer (e.g., Evince), where the PolyBezierSegment or PolyQuadraticBezierSegment Points attribute specifies a point count not divisible by three (quadratic/bezier arity mismatch), driving path_geometry_start_element() to read past the heap allocation. Limiting factors: it is a local, file-based attack (AV:L) that depends on user interaction (UI:P) - the user must choose to open the malicious file - and there is no privilege or authentication bypass and no code execution; realistic impact is a crash and limited disclosure of adjacent heap contents rendered into output, which constrains it well below remote unauthenticated severity.

The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H) scores 6.9 (medium) and the signals are internally consistent: this is a local, low-complexity, unauthenticated flaw that nonetheless requires passive user interaction (UI:P) - the victim must open or render a crafted XPS document. The dominant impact is availability (VA:H, a crash of consumers like Evince) with only limited confidentiality exposure (VC:L, adjacent heap bytes rendered into output); there is no integrity impact. No EPSS score was supplied, so exploitation probability cannot be quantified, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. A detailed technical write-up with a crafted-document reproduction is published on hackmd by the reporting researcher (VulnCheck), so public proof-of-concept material exists, but POC availability is distinct from active exploitation and should not be conflated. Net assessment: this is a genuine but moderate-priority client-side memory-safety bug - primarily a denial-of-service with a secondary information-leak - not a mass-exploitable remote threat. It warrants patching on systems that process untrusted XPS files, but is not an emergency relative to network-facing unauthenticated RCE. Note: EPSS data is missing and the fix/patch version is not provided in the input, which should be verified with the vendor.

An attacker crafts a malicious XPS document whose PolyBezierSegment or PolyQuadraticBezierSegment Points attribute contains a point count not divisible by three (or two), then delivers it to a victim via email or download. When the victim opens the file in a libgxps-based consumer such as Evince, path_geometry_start_element() reads past the allocation, crashing the viewer or rendering adjacent heap memory into the output. A public technical write-up/PoC describing the crafted-document trigger is available from the reporter.