CVE-2026-112922
Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
3.3
Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.
- Record
CVE-2026-112922- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-113475
3.3
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.
- Record
EUVD-2026-113475- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cxh6-m3hf-v489
3.3
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a...
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.
- Record
GHSA-cxh6-m3hf-v489- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
3.3
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.
- Record
CVE-2026-112922- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-112922
3.3
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.
- Record
DEBIAN-CVE-2026-112922- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-112922
3.3
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.
- Record
UBUNTU-CVE-2026-112922- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ghostscriptDebian:12 |
All versions, plus listed versions 10.0.0~dfsg-1110.0.0~dfsg-11+deb12u110.0.0~dfsg-11+deb12u210.0.0~dfsg-11+deb12u310.0.0~dfsg-11+deb12u4 Show 28 moreShow less10.0.0~dfsg-11+deb12u510.0.0~dfsg-11+deb12u610.0.0~dfsg-11+deb12u710.0.0~dfsg-11+deb12u810.01.2~dfsg-110.02.0~dfsg-110.02.0~dfsg-210.02.1~dfsg-110.02.1~dfsg-210.02.1~dfsg-310.03.0~dfsg-110.03.1~dfsg-110.03.1~dfsg-210.03.1~dfsg~git20240518-110.04.0~dfsg-110.04.0~dfsg-210.05.0~dfsg-110.05.1~dfsg-110.05.1~dfsg-210.05.1~dfsg-310.06.0~dfsg-110.06.0~dfsg-210.06.0~dfsg-310.07.0~dfsg-110.07.0~dfsg-210.07.1~dfsg-110.08.0~dfsg-110.08.0~dfsg-2 |
None known |
ghostscriptDebian:13 |
All versions, plus listed versions 10.05.1~dfsg-110.05.1~dfsg-1+deb13u110.05.1~dfsg-1+deb13u210.05.1~dfsg-1+deb13u310.05.1~dfsg-2 Show 9 moreShow less10.05.1~dfsg-310.06.0~dfsg-110.06.0~dfsg-210.06.0~dfsg-310.07.0~dfsg-110.07.0~dfsg-210.07.1~dfsg-110.08.0~dfsg-110.08.0~dfsg-2 |
None known |
ghostscriptDebian:14 |
before 10.08.0~dfsg-1, plus listed versions 10.05.1~dfsg-110.05.1~dfsg-210.05.1~dfsg-310.06.0~dfsg-110.06.0~dfsg-2 Show 4 moreShow less10.06.0~dfsg-310.07.0~dfsg-110.07.0~dfsg-210.07.1~dfsg-1 |
10.08.0~dfsg-1 |
ghostscriptUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 9.16~dfsg~0-0ubuntu39.16~dfsg~0-0ubuntu49.18~dfsg~0-0ubuntu19.18~dfsg~0-0ubuntu29.18~dfsg~0-0ubuntu2.2 Show 33 moreShow less9.18~dfsg~0-0ubuntu2.39.18~dfsg~0-0ubuntu2.49.18~dfsg~0-0ubuntu2.69.18~dfsg~0-0ubuntu2.79.18~dfsg~0-0ubuntu2.89.18~dfsg~0-0ubuntu2.99.25~dfsg+1-0ubuntu0.16.04.19.25~dfsg+1-0ubuntu0.16.04.29.25~dfsg+1-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.19.26~dfsg+0-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.49.26~dfsg+0-0ubuntu0.16.04.59.26~dfsg+0-0ubuntu0.16.04.69.26~dfsg+0-0ubuntu0.16.04.79.26~dfsg+0-0ubuntu0.16.04.89.26~dfsg+0-0ubuntu0.16.04.99.26~dfsg+0-0ubuntu0.16.04.109.26~dfsg+0-0ubuntu0.16.04.119.26~dfsg+0-0ubuntu0.16.04.129.26~dfsg+0-0ubuntu0.16.04.139.26~dfsg+0-0ubuntu0.16.04.149.26~dfsg+0-0ubuntu0.16.04.14+esm19.26~dfsg+0-0ubuntu0.16.04.14+esm29.26~dfsg+0-0ubuntu0.16.04.14+esm39.26~dfsg+0-0ubuntu0.16.04.14+esm49.26~dfsg+0-0ubuntu0.16.04.14+esm59.26~dfsg+0-0ubuntu0.16.04.14+esm69.26~dfsg+0-0ubuntu0.16.04.14+esm79.26~dfsg+0-0ubuntu0.16.04.14+esm89.26~dfsg+0-0ubuntu0.16.04.14+esm99.26~dfsg+0-0ubuntu0.16.04.14+esm109.26~dfsg+0-0ubuntu0.16.04.14+esm11 |
None known |
ghostscriptUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 9.21~dfsg+1-0ubuntu39.22~dfsg+1-0ubuntu19.22~dfsg+1-0ubuntu1.19.22~dfsg+1-0ubuntu1.29.25~dfsg+1-0ubuntu0.18.04.1 Show 24 moreShow less9.25~dfsg+1-0ubuntu0.18.04.29.26~dfsg+0-0ubuntu0.18.04.19.26~dfsg+0-0ubuntu0.18.04.39.26~dfsg+0-0ubuntu0.18.04.49.26~dfsg+0-0ubuntu0.18.04.59.26~dfsg+0-0ubuntu0.18.04.69.26~dfsg+0-0ubuntu0.18.04.79.26~dfsg+0-0ubuntu0.18.04.89.26~dfsg+0-0ubuntu0.18.04.99.26~dfsg+0-0ubuntu0.18.04.109.26~dfsg+0-0ubuntu0.18.04.119.26~dfsg+0-0ubuntu0.18.04.129.26~dfsg+0-0ubuntu0.18.04.139.26~dfsg+0-0ubuntu0.18.04.149.26~dfsg+0-0ubuntu0.18.04.159.26~dfsg+0-0ubuntu0.18.04.169.26~dfsg+0-0ubuntu0.18.04.179.26~dfsg+0-0ubuntu0.18.04.189.26~dfsg+0-0ubuntu0.18.04.18+esm19.26~dfsg+0-0ubuntu0.18.04.18+esm29.26~dfsg+0-0ubuntu0.18.04.18+esm39.26~dfsg+0-0ubuntu0.18.04.18+esm49.26~dfsg+0-0ubuntu0.18.04.18+esm59.26~dfsg+0-0ubuntu0.18.04.18+esm6 |
None known |
ghostscriptUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 9.27~dfsg+0-0ubuntu39.27~dfsg+0-0ubuntu49.50~dfsg-5ubuntu19.50~dfsg-5ubuntu29.50~dfsg-5ubuntu3 Show 19 moreShow less9.50~dfsg-5ubuntu49.50~dfsg-5ubuntu4.19.50~dfsg-5ubuntu4.29.50~dfsg-5ubuntu4.39.50~dfsg-5ubuntu4.49.50~dfsg-5ubuntu4.59.50~dfsg-5ubuntu4.69.50~dfsg-5ubuntu4.79.50~dfsg-5ubuntu4.89.50~dfsg-5ubuntu4.99.50~dfsg-5ubuntu4.109.50~dfsg-5ubuntu4.119.50~dfsg-5ubuntu4.129.50~dfsg-5ubuntu4.139.50~dfsg-5ubuntu4.149.50~dfsg-5ubuntu4.159.50~dfsg-5ubuntu4.15+esm19.50~dfsg-5ubuntu4.15+esm29.50~dfsg-5ubuntu4.15+esm3 |
None known |
ghostscriptUbuntu:22.04:LTS |
All versions, plus listed versions 9.54.0~dfsg1-0ubuntu29.55.0~dfsg1-0ubuntu49.55.0~dfsg1-0ubuntu59.55.0~dfsg1-0ubuntu5.19.55.0~dfsg1-0ubuntu5.2 Show 12 moreShow less9.55.0~dfsg1-0ubuntu5.39.55.0~dfsg1-0ubuntu5.49.55.0~dfsg1-0ubuntu5.59.55.0~dfsg1-0ubuntu5.69.55.0~dfsg1-0ubuntu5.79.55.0~dfsg1-0ubuntu5.99.55.0~dfsg1-0ubuntu5.109.55.0~dfsg1-0ubuntu5.119.55.0~dfsg1-0ubuntu5.129.55.0~dfsg1-0ubuntu5.139.55.0~dfsg1-0ubuntu5.149.55.0~dfsg1-0ubuntu5.15 |
None known |
ghostscriptUbuntu:24.04:LTS |
All versions, plus listed versions 10.01.2~dfsg1-0ubuntu210.01.2~dfsg1-0ubuntu2.110.02.1~dfsg1-0ubuntu110.02.1~dfsg1-0ubuntu210.02.1~dfsg1-0ubuntu5 Show 11 moreShow less10.02.1~dfsg1-0ubuntu610.02.1~dfsg1-0ubuntu710.02.1~dfsg1-0ubuntu7.110.02.1~dfsg1-0ubuntu7.310.02.1~dfsg1-0ubuntu7.410.02.1~dfsg1-0ubuntu7.510.02.1~dfsg1-0ubuntu7.610.02.1~dfsg1-0ubuntu7.710.02.1~dfsg1-0ubuntu7.810.02.1~dfsg1-0ubuntu7.910.02.1~dfsg1-0ubuntu7.10 |
None known |
ghostscriptUbuntu:26.10 |
All versions, plus listed versions 10.06.0~dfsg-3ubuntu110.07.1~dfsg-1ubuntu110.07.1~dfsg-1ubuntu210.07.1~dfsg-1ubuntu2.1 |
None known |
ghostscriptUbuntu:26.04:LTS |
All versions, plus listed versions 10.05.0dfsg1-0ubuntu410.05.0dfsg1-0ubuntu510.06.0~dfsg-3ubuntu110.06.0~dfsg-3ubuntu1.110.06.0~dfsg-3ubuntu1.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-112922 is a low vulnerability (CVSS 3.3) in Red Hat Enterprise Linux 10, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in ghostscript 10.08.0~dfsg-1.