CVE-2026-110133: 
Ghostscript vulnerability analysis and mitigation

CVE-2026-110133 is a heap-based buffer overflow vulnerability in Ghostscript affecting its TrueType font outliner. When processing a specially crafted TrueType font or a document embedding one, an accounting error (integer underflow in nPointsTotal) during font rendering bypasses buffer size checks, triggering a heap out-of-bounds write. The affected component is ghostscript-10.02.1-16.el10_0 (Red Hat Enterprise Linux 10), with the flaw located in base/ttfmain.c within the ttfOutliner__BuildGlyphOutlineAux function. It was reported on April 26, 2026, and publicly disclosed on October 29–30, 2026. The CVSS v3.1 base score is 5.8 (Medium), though the original bug report assessed it as HIGH (8.8) under a network-reachable attack vector scenario (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow), triggered by an integer underflow in the nPointsTotal counter within ttfOutliner__BuildGlyphOutlineAux in base/ttfmain.c. When a glyph triggers a fBadInstruction error and the outliner retries without hinting, it subtracts nPoints + 2 from nPointsTotal — a larger value than was previously added — causing the signed counter to drift negative. Once negative, the capacity guard self->nPointsTotal + nPoints + 2 > exec->n_points underestimates actual buffer occupancy, allowing subsequent point writes (pts->org_x, pts->org_y) to exceed the allocated heap buffer. The composite-glyph hinting path exacerbates the issue by subtracting counts that were never added in that frame. Exploitation requires an attacker to supply a crafted TrueType font (or a document embedding one) and have it rendered through the affected outliner path with TrueType instruction execution enabled; no prior privileges are required, but user interaction (opening the malicious content) is needed (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can result in a Denial of Service (DoS) crash of the Ghostscript process or, in more severe cases, arbitrary code execution within the context of the Ghostscript process. The heap out-of-bounds write primitive can plausibly expose or corrupt process memory, leading to high confidentiality and integrity impact. Availability impact is rated None in the official CVSS score, though the bug report notes crash as the minimum likely outcome; automated document-processing pipelines (e.g., print servers, document converters) that process untrusted content are at elevated risk (Red Hat CVE, Red Hat Bugzilla).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is 0.0, indicating very low current probability of exploitation in the wild (GitHub Advisory). The CVE status is "Awaiting Analysis" and it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability was discovered by AISLE Research in partnership with Red Hat (Red Hat CVE).

1. Craft a malicious TrueType font: Create a TrueType font file containing composite glyphs with embedded bytecode designed to trigger TT_Err_Invalid_Opcode or similar interpreter errors, causing error to become fBadInstruction in the outliner. Ensure cumulative point usage is close to exec->n_points to make the capacity check tight.
2. Embed in a document: Optionally embed the crafted font in a PDF, PostScript, or other document format supported by Ghostscript to increase the likelihood of it being processed by an automated service or opened by a victim.
3. Deliver the payload: Send the malicious font or document to the target via email attachment, web download, shared storage, or any channel that causes Ghostscript to render it (e.g., a print server, document conversion pipeline, or direct user interaction).
4. Trigger the vulnerability: When Ghostscript processes the crafted font through ttfOutliner__BuildGlyphOutlineAux, the retry path subtracts nPoints + 2 from nPointsTotal, driving it negative and weakening the capacity guard.
5. Achieve heap out-of-bounds write: Subsequent point writes (pts->org_x, pts->org_y) exceed the allocated buffer, resulting in heap memory corruption — at minimum causing a crash (DoS), and potentially enabling arbitrary code execution if the overflow is controlled sufficiently (Red Hat Bugzilla).

• Process: Ghostscript process (gs, ghostscript) crashing unexpectedly or producing segmentation faults when processing font-containing documents; unusual child processes spawned from Ghostscript in automated pipelines.
• Logs: Application or system logs showing Ghostscript crashes (SIGSEGV, SIGABRT) or AddressSanitizer heap-buffer-overflow reports referencing ttfOutliner__BuildGlyphOutlineAux or base/ttfmain.c; repeated processing failures on the same document.
• File System: Unexpected or newly appeared TrueType font files (.ttf, .otf) or documents (.pdf, .ps) in directories processed by Ghostscript; core dump files generated by Ghostscript crashes.
• Network: Unusual inbound delivery of font-embedded documents to automated Ghostscript processing services (e.g., print spoolers, document converters) from external or untrusted sources.

Red Hat has identified a patch (proposed fix: save and restore nPointsTotal and nContoursTotal before the retry block rather than applying arithmetic rollback) tracked under RHEL-189163, though no released package fix was established at initial disclosure (Red Hat Bugzilla). Users should monitor Red Hat advisories for an updated ghostscript package. In the interim, Red Hat recommends: (1) avoid processing untrusted documents or standalone TrueType fonts with Ghostscript; (2) disable TrueType instruction execution in Ghostscript configuration if feasible (this avoids the fBadInstruction retry path); (3) run Ghostscript in a restrictive sandbox environment (e.g., seccomp, containers, or dedicated low-privilege accounts) to limit blast radius (Red Hat CVE).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported via Red Hat's coordinated disclosure process, with an embargo period prior to public disclosure (Red Hat CVE). The GitHub Advisory Database classified it as "Moderate" severity based on the official CVSS score of 5.8, while the original bug report argued for a HIGH (8.8) rating under a network-reachable scenario (GitHub Advisory). No significant broader media coverage or notable public researcher commentary beyond the official advisory channels has been identified at this time.