CVE-2026-112922: 
Ghostscript vulnerability analysis and mitigation

CVE-2026-112922 is an out-of-bounds read vulnerability in Ghostscript affecting the shade_next_color function in mesh shading processing. A remote attacker can exploit this by enticing a user to open a specially crafted PDF or PostScript document containing malicious mesh shading data with oversized indexed color values, triggering improper bounds validation. The vulnerability was reported on April 26, 2026, and publicly disclosed on October 29–30, 2026. Affected software includes Ghostscript as packaged in Red Hat Enterprise Linux (specifically identified in ghostscript-10.02.1-16.el10_0); specific upstream version ranges are not yet fully enumerated. It carries a CVSS v3.1 base score of 3.3 (Low) (Red Hat CVE, Github Advisory).

The root cause is an integer overflow and insufficient bounds validation in shade_next_color (CWE-125: Out-of-bounds Read) within base/gxshade.c. When processing a mesh shading with an Indexed color space, a large attacker-controlled Decode upper bound (e.g., 3000000000) causes a decoded floating-point color value to overflow when cast to int, potentially producing a negative index. Because the code only rejects negative cf values and checks ci only against the upper bound, a negative ci bypasses validation and reaches gs_cspace_indexed_lookup in base/gscolor2.c, where it is used directly for pointer arithmetic (table.data + m * index), resulting in an out-of-bounds read of adjacent heap memory. Exploitation requires no authentication or local access, but the target must be induced to process a crafted PDF or PostScript file; the vulnerability is reachable via both the PostScript (psi/zshade.c) and PDF (pdf/pdf_shading.c) parsing paths (Red Hat Bugzilla).

Successful exploitation can result in limited disclosure of adjacent heap memory (copied into rendered color component values, observable if output is accessible) or a Denial of Service via application crash of the Ghostscript process. There is no demonstrated write primitive or code execution path, and the scope is confined to the Ghostscript process handling the document. The impact is limited to confidentiality (low) and availability within the affected process, with no integrity impact (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time; the Feedly executive summary confirms this (Red Hat CVE). The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The CVE status is currently "Awaiting Analysis" and it has not been added to the CISA Known Exploited Vulnerabilities catalog. A minimal PoC was noted as available for private sharing by the original reporter (AISLE Research in partnership with Red Hat), but has not been publicly released (Red Hat Bugzilla).

1. Craft a malicious document: Create a PDF or PostScript file containing a mesh shading object that uses an Indexed color space with BitsPerComponent set to 16 and a Decode array with an extremely large upper bound (e.g., 3000000000), designed to cause integer overflow when the decoded float is cast to int in shade_next_color.
2. Deliver the document: Distribute the crafted file to a target user via email attachment, web download, or any channel that causes the user to open it with Ghostscript (e.g., as part of a document conversion pipeline or print workflow).
3. Trigger processing: The target user opens or processes the file with Ghostscript (e.g., gs -dNOPAUSE -dBATCH -sDEVICE=pngmono -sOutputFile=out.png malicious.pdf), causing the mesh shading parser to decode the oversized color value.
4. Trigger out-of-bounds read: The oversized decoded float overflows on cast to int, producing a negative index that bypasses bounds checks in shade_next_color and reaches gs_cspace_indexed_lookup, which performs pointer arithmetic with the invalid index, reading memory before the palette buffer.
5. Achieve objective: Depending on build and memory layout, the attacker observes either a process crash (DoS) or, if rendered output is accessible, limited disclosure of adjacent heap bytes copied into color component values (Red Hat Bugzilla).

• Process: Ghostscript process (gs) crashing unexpectedly or producing garbled/incorrect color output when rendering PDF or PostScript files containing mesh shadings.
• Logs: Application crash logs or core dumps referencing shade_next_color, gs_cspace_indexed_lookup, base/gxshade.c, or base/gscolor2.c; AddressSanitizer or UndefinedBehaviorSanitizer reports mentioning invalid reads at table.data + m * index.
• File System: Presence of unexpected or externally sourced PDF/PostScript files with mesh shading objects using Indexed color spaces and unusually large Decode array values (upper bounds in the billions).
• Network: Delivery of crafted PDF or PostScript files from untrusted external sources to systems running Ghostscript in document processing pipelines.

Red Hat has stated that no mitigation meeting their deployment and ease-of-use criteria is currently available for this vulnerability (Red Hat CVE). A tracker for a fix in RHEL 10.3 has been filed (RHEL-189171). As interim measures, avoid processing untrusted PDF or PostScript files with Ghostscript in the same privilege context as trusted workloads; isolate Ghostscript in a dedicated low-privilege container or sandbox; and where feasible, reject or sanitize documents containing mesh shadings with Indexed color spaces or unusually large Decode ranges. A proposed upstream patch adds pre-cast float range validation and a defensive lower-bound check in both base/gxshade.c and base/gscolor2.c (Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported via Red Hat's security process. Red Hat has classified it as Low severity (CVSS 3.3) and noted no currently available mitigation meets their deployment criteria. No significant public researcher commentary, social media discussion, or broader media coverage has been observed at this time, consistent with the low CVSS score and absence of public exploit code (Red Hat CVE).