Skip to content
OpenAdvisories
Low · 3.3 CVE-2026-112922 EUVD-2026-113475GHSA-cxh6-m3hf-v489

Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading

Published Oct 30, 2026 · Updated Nov 6, 2026 · Assigned by redhat

Description

A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ghostscript 10.08.0~dfsg-1 —
Debian 13 ghostscript No fix yet —
Debian 12 ghostscript No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 ghostscript No fix yet —
Ubuntu 26.04 LTS ghostscript No fix yet —
Ubuntu 24.04 LTS ghostscript No fix yet —
Ubuntu 22.04 LTS ghostscript No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS ghostscript No fix yet —
Ubuntu Pro 18.04 LTS ghostscript No fix yet —
Ubuntu Pro 16.04 LTS ghostscript No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ghostscript 10.08.0-5.1 openSUSE-SU-2026:12528-1

Advisories 2

References