---
id: CVE-2026-112922
title: >-
  Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer
  overflow of indexed color index in mesh shading
summary: >-
  A flaw was found in Ghostscript. A remote attacker could exploit this
  vulnerability by enticing a user to process a specially crafted PDF or
  PostScript document containing malicious mesh shading data. Due to improper
  bounds validation du…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: Red Hat
product: ghostscript
affected:
  - ghostscript (all versions)
  - ghostscript
  - ghostscript (all versions)
  - ghostscript (all versions)
  - ghostscript (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:20:46.922332Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:58:20.193Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112922'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-112922'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2463016'
    label: RHBZ#2463016
tags:
  - cve.org
epss: 0.00141
epssPercentile: 0.0345
ingestedAt: '2026-11-05T16:24:31.046Z'
---

## Overview

A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.

## Affected

- `ghostscript (all versions)`
- `ghostscript`
- `ghostscript (all versions)`
- `ghostscript (all versions)`
- `ghostscript (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.