Live › vulnerability › CVE-2026-110133
A crafted TrueType font or document embedding one can bypass a buffer size check during font rendering in Ghostscript. An attacker who gets a victim or automated service to open the file can crash it or possibly run arbitrary code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 01:27 UTC. All times on this page are UTC.
Systems that run Ghostscript on documents from outside the organization, such as document converters, thumbnailers or print pipelines. Teams that only process trusted local files are less exposed. The sources do not list affected version ranges.
No product ranges from the sources yet.
gs --versionNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-110133")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.