CVE-2026-110133— Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback

Quick assessment

Affected

Red Hat Red Hat Enterprise Linux 10

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Ghostscript 中发现了一个漏洞。当处理经过特制的 TrueType 字体或嵌入了此类字体的文档时，字体渲染过程中的会计错误可能绕过缓冲区大小检查，从而引发堆缓冲区溢出。远程攻击者可通过诱骗受害者或自动化服务打开恶意内容来利用该漏洞，可能导致拒绝服务（DoS）崩溃或任意代码执行。

CVSS 5.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1068.001 T1190 · Exploit Public-Facing Application T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

堆缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/o:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:enterprise_linux:6`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:enterprise_linux:7`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/o:redhat:enterprise_linux:9`

II. Public POCs for CVE-2026-110133

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-110133

请登录查看更多情报信息。

Other References for CVE-2026-110133 (2)

https://access.redhat.com/security/cve/CVE-2026-110133 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2461973 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-110133

Same Patch Batch · Red Hat · 2026-10-30 · 6 CVEs total

CVE-2026-91920	6.5 MEDIUM	Undertow: undertow: chunkreader message length permits chunk-size overflow
CVE-2026-118959	5.4 MEDIUM	Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter
CVE-2026-118947	4.3 MEDIUM	Keycloak-services: keycloak-services: authorization bypass via uma resource registration i
CVE-2026-118475	3.6 LOW	Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp
CVE-2026-112922	3.3 LOW	Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of in

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10

Same vendor: Red Hat

Same weakness: CWE-122