CVE-2026-112922— Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading

Quick assessment

Affected

Red Hat Red Hat Enterprise Linux 10

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Ghostscript 中发现了一个安全漏洞。远程攻击者可通过诱使用户处理包含恶意网格着色数据的特制 PDF 或 PostScript 文档来利用该漏洞。由于在处理索引颜色值时未进行适当的边界检查，Ghostscript 会触发越界内存读取。成功利用该漏洞可能导致应用程序崩溃，从而引发拒绝服务（DoS）攻击，或造成有限的信息泄露。

CVSS 3.3 · Low Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1068 · Exploitation for Privilege Escalation T1070 · Indicator Removal T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/o:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:enterprise_linux:6`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:enterprise_linux:7`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/o:redhat:enterprise_linux:9`

II. Public POCs for CVE-2026-112922

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-112922

请登录查看更多情报信息。

Other References for CVE-2026-112922 (2)

https://access.redhat.com/security/cve/CVE-2026-112922 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2463016 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-112922

Same Patch Batch · Red Hat · 2026-10-30 · 6 CVEs total

CVE-2026-91920	6.5 MEDIUM	Undertow: undertow: chunkreader message length permits chunk-size overflow
CVE-2026-110133	5.8 MEDIUM	Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal int
CVE-2026-118959	5.4 MEDIUM	Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter
CVE-2026-118947	4.3 MEDIUM	Keycloak-services: keycloak-services: authorization bypass via uma resource registration i
CVE-2026-118475	3.6 LOW	Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10

Same vendor: Red Hat

Same weakness: CWE-125