{"id":"CVE-2026-112922","kind":"vulnerability","aliases":["CVE-2026-112922"],"related":[],"title":"Ghostscript: crafted PDF or PostScript file causes out-of-bounds memory read","description":"A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.","summary":"Ghostscript reads memory outside its bounds when processing indexed color values in a crafted mesh shading PDF or PostScript file. An attacker who gets a user to open such a document can crash the process or leak limited information.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["document-processing","ghostscript","package","self-hosted"],"not_affected_if":["no-ghostscript-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-30T02:17:08+00:00","first_seen_at":"2026-10-30T02:28:05+00:00","triaged_at":"2026-10-30T02:30:07+00:00","updated_at":"2026-10-30T02:30:07+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T02:30:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Ghostscript: crafted PDF or PostScript file causes out-of-bounds memory read","impact":"low","summary":"Ghostscript reads memory outside its bounds when processing indexed color values in a crafted mesh shading PDF or PostScript file. An attacker who gets a user to open such a document can crash the process or leak limited information.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ghostscript","self-hosted","document-processing"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"process crash or limited memory data disclosure","analyst_note":"Check the NVD entry and upstream Ghostscript advisories for affected and fixed versions and whether default builds are affected.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-ghostscript-installed"],"who_is_affected":"Any system that runs Ghostscript to render or convert PDF or PostScript files, such as document converters, print or preview pipelines, or upload processing, is potentially exposed. The sources do not name affected versions or say whether default configurations are vulnerable.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000641,"input_tokens":4146,"output_tokens":452,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112922':16A,19A '-2026':15A,18A 'applic':131C 'attack':49B,75C 'bound':11A,33B,101C,116C 'caus':7A 'color':37B,108C 'contain':93C 'could':76C 'craft':2A,41B,88C 'crash':60B,132C 'cve':14A,17A 'data':97C 'denial':125C 'disclosur':138C 'document':21B,58B,92C 'document-process':20B 'dos':128C 'due':98C 'entic':81C 'exploit':77C,120C 'file':6A,47B 'flaw':68C 'found':70C 'get':51B 'ghostscript':1A,23B,28B,72C,110C 'host':27B 'improp':100C 'index':36B,107C 'inform':66B,137C 'lead':122C 'leak':64B 'limit':65B,136C 'malici':94C 'memori':12A,30B,117C 'mesh':42B,95C 'open':55B 'out-of-bound':8A,113C 'outsid':31B 'packag':24B 'pdf':3A,44B,89C 'postscript':5A,46B,91C 'process':22B,35B,62B,85C,105C 'read':13A,29B,118C 'remot':74C 'result':134C 'self':26B 'self-host':25B 'servic':127C 'shade':43B,96C 'special':87C 'success':119C 'trigger':111C 'user':53B,83C 'valid':102C 'valu':38B,109C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Any system that runs Ghostscript to render or convert PDF or PostScript files, such as document converters, print or preview pipelines, or upload processing, is potentially exposed. The sources do not name affected versions or say whether default configurations are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T02:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112922","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112922","severity":null,"published_at":"2026-10-30T02:17:08+00:00","modified_at":"2026-10-30T02:17:08+00:00","first_seen_at":"2026-10-30T02:28:05+00:00","fetched_at":"2026-10-30T02:28:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}