GNOME libgxps contains a heap out‑of‑bounds read in the path_geometry_start_element() function. A crafted XPS document that includes PolyBezierSegment or PolyQuadraticBezierSegment Points attributes with a point count not divisible by three or two causes the parser to read past the allocated buffer, exposing adjacent heap memory. This can lead to the disclosure of sensitive data or the crashing of applications that consume XPS files.

Any installation of GNOME libgxps version 0.3.2 or earlier is vulnerable. The library is bundled in many Linux desktop environments and is used by XPS consumers such as Evince. Users who open malicious XPS files in these applications are affected. This inference is based on the library's typical use in XPS consumer applications.

The CVSS score of 6.9 indicates medium severity, and the EPSS score of 0.129% (less than 1%) suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. An attacker can provide a malicious XPS file via USB, email, or a web link to trigger the out‑of‑bounds read; no elevated privileges or code execution are required, but the outcome can be data leakage or denial of service.