Vulnerability · Published Oct 30, 2026 · Assigned by redhat
CVE-2026-110133Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback
Medium 5.8
In plain English
A medium-severity heap buffer overflow in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ghostscript | no fix listed | DEBIAN-CVE-2026-110133 |
| Debian:13 | ghostscript | no fix listed | DEBIAN-CVE-2026-110133 |
| Debian:14 | ghostscript | 10.08.0~dfsg-1 | DEBIAN-CVE-2026-110133 |
| Ubuntu:22.04:LTS | ghostscript | no fix listed | UBUNTU-CVE-2026-110133 |
| Ubuntu:24.04:LTS | ghostscript | no fix listed | UBUNTU-CVE-2026-110133 |
| Ubuntu:26.04:LTS | ghostscript | no fix listed | UBUNTU-CVE-2026-110133 |
| Ubuntu:26.10 | ghostscript | no fix listed | UBUNTU-CVE-2026-110133 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-110133 vdb-entry, x_refsource_REDHAT
- RHBZ#2461973 issue-tracking, x_refsource_REDHAT