Vulnerability · Published Oct 30, 2026 · Assigned by redhat
CVE-2026-112922Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading
Low 3.3
In plain English
A low-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ghostscript | no fix listed | DEBIAN-CVE-2026-112922 |
| Debian:13 | ghostscript | no fix listed | DEBIAN-CVE-2026-112922 |
| Debian:14 | ghostscript | 10.08.0~dfsg-1 | DEBIAN-CVE-2026-112922 |
| Ubuntu:22.04:LTS | ghostscript | no fix listed | UBUNTU-CVE-2026-112922 |
| Ubuntu:24.04:LTS | ghostscript | no fix listed | UBUNTU-CVE-2026-112922 |
| Ubuntu:26.04:LTS | ghostscript | no fix listed | UBUNTU-CVE-2026-112922 |
| Ubuntu:26.10 | ghostscript | no fix listed | UBUNTU-CVE-2026-112922 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
References
- https://access.redhat.com/security/cve/CVE-2026-112922 vdb-entry, x_refsource_REDHAT
- RHBZ#2463016 issue-tracking, x_refsource_REDHAT