CVE-2026-111132
Description
A flaw was found in libgxps. An attacker can exploit this vulnerability by convincing a user to open a specially crafted XML Paper Specification (XPS) document containing malformed curve segment attributes. Successful exploitation triggers an out-of-bounds memory read, primarily causing an application crash that results in a Denial of Service (DoS), or potentially exposing adjacent memory data.
Mitigation
Avoid opening untrusted or unsolicited XPS files in document viewers such as Evince, and do not process unverified files with utilities linked against libgxps.
On systems where XPS document rendering is unnecessary, exposure can be eliminated by removing the libgxps package:
# dnf remove libgxps
Caveat: Removing libgxps may prompt the removal of dependent graphical desktop packages or viewer components. Verify that required desktop functionality is not impaired before proceeding. Headless server environments remain unaffected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 6.1 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
