AZL-108263
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108263.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-108263
- Upstream
- Published
- 2026-10-15T19:17:26Z
- Modified
- 2026-10-16T14:16:18Z
- Summary
- CVE-2026-111132 affecting package libgxps 0.3.2-1
- Details
-
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.
- References