Gnome Libgxps vulnerabilities

4 CVEs affecting Gnome Libgxps, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-111132, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-10767, published 2018-05-06. Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days. There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from…
CVE-2018-10733, published 2018-05-04. Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days. There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. A crafted input will lead to a remote denial of service attack.
CVE-2017-11590, published 2017-07-24. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. There is a NULL pointer dereference in the caseless_hash function in gxps-archive.c in libgxps 0.2.5. A crafted input will lead to a remote denial of service attack.
CVE-2026-111132, published 2026-10-15. Medium severity, CVSS 6.1. EPSS: 0.1% chance of exploitation in the next 30 days. GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or…