{"id":"CVE-2026-110133","kind":"vulnerability","aliases":["CVE-2026-110133"],"related":[],"title":"Ghostscript: crafted TrueType font overflows heap, risking crash or code execution","description":"A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.","summary":"A crafted TrueType font or document embedding one can bypass a buffer size check during font rendering in Ghostscript. An attacker who gets a victim or automated service to open the file can crash it or possibly run arbitrary code.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-processing","ghostscript","linux","runtime"],"not_affected_if":["no-ghostscript-installed","trusted-input-only"],"how_to_check":"- Check the installed Ghostscript version with `gs --version`\n- Find services or pipelines that render untrusted PDFs or PostScript files with Ghostscript","fix":null,"status":"open","published_at":"2026-10-30T01:16:43+00:00","first_seen_at":"2026-10-30T01:27:58+00:00","triaged_at":"2026-10-30T01:29:39+00:00","updated_at":"2026-10-30T01:29:39+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T01:29:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Ghostscript: crafted TrueType font overflows heap, risking crash or code execution","impact":"high","summary":"A crafted TrueType font or document embedding one can bypass a buffer size check during font rendering in Ghostscript. An attacker who gets a victim or automated service to open the file can crash it or possibly run arbitrary code.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ghostscript","document-processing","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs on the processing host after a crafted file is opened","analyst_note":"Sources list no affected or fixed versions; check the NVD entry and the Ghostscript release notes for the fixed version.","how_to_check":"- Check the installed Ghostscript version with `gs --version`\n- Find services or pipelines that render untrusted PDFs or PostScript files with Ghostscript","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-ghostscript-installed"],"who_is_affected":"Systems that run Ghostscript on documents from outside the organization, such as document converters, thumbnailers or print pipelines. Teams that only process trusted local files are less exposed. The sources do not list affected version ranges.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000665,"input_tokens":4133,"output_tokens":503,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110133':14A,17A '-2026':13A,16A 'account':82C 'arbitrari':62B,127C 'attack':44B,101C 'autom':50B,110C 'base':96C 'buffer':35B,89C,97C 'bypass':33B,88C 'check':37B,91C 'code':10A,63B,128C 'content':116C 'could':102C 'craft':2A,25B,74C 'crash':8A,57B,125C 'cve':12A,15A 'denial':121C 'document':19B,29B,78C 'document-process':18B 'dos':124C 'embed':30B,79C 'entic':106C 'error':83C 'execut':11A,129C 'exploit':103C 'file':55B 'flaw':65C 'font':4A,27B,39B,76C,85C 'found':67C 'get':46B 'ghostscript':1A,21B,42B,69C 'heap':6A,95C 'heap-bas':94C 'linux':22B 'malici':115C 'one':31B,80C 'open':53B,113C 'overflow':5A,98C 'possibl':60B 'potenti':117C 'process':20B,71C 'remot':100C 'render':40B,86C 'result':118C 'risk':7A 'run':61B 'runtim':23B 'servic':51B,111C,123C 'size':36B,90C 'special':73C 'trigger':92C 'truetyp':3A,26B,75C 'victim':48B,108C","nicknames":[],"mitigations":[],"who_affected":"Systems that run Ghostscript on documents from outside the organization, such as document converters, thumbnailers or print pipelines. Teams that only process trusted local files are less exposed. The sources do not list affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T01:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110133","severity":null,"published_at":"2026-10-30T01:16:43+00:00","modified_at":"2026-10-30T01:16:43+00:00","first_seen_at":"2026-10-30T01:27:58+00:00","fetched_at":"2026-10-30T01:27:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}