Ghostscript CVE-2026-110133

Exploitation requires Ghostscript to process attacker-controlled input - specifically a specially crafted TrueType font, or a document that embeds such a font - through its font-rendering path; the overflow occurs when an accounting error lets the crafted font bypass buffer size checks. The trigger therefore depends on a victim or an automated service actually opening/rendering the malicious content (UI:R), and the supplied vector marks the vector as local (AV:L), meaning the malicious file must reach and be processed on the target system rather than being exploitable over a live network protocol. Limiting factors: the attacker must induce processing of the file (user interaction or an automated ingestion workflow that feeds untrusted documents to Ghostscript), and exploitation targets whatever account/service runs the rendering. The exact low-level trigger beyond 'an accounting error during font rendering' is not further detailed in the available sources. Automated document-conversion or print pipelines that render untrusted uploads are the most realistic exposure.

Signals are moderate and partly conflicting. The provided CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N, base 5.8) describes a locally-triggered, high-privilege, user-interaction-dependent flaw with high confidentiality and integrity impact but NO availability impact - yet the description explicitly says the outcome can be a Denial-of-Service crash, so the A:N rating directly contradicts the stated DoS impact and should be verified with Red Hat. The PR:H rating is also unusual for a font/document parsing bug, where the attacker typically supplies a file and requires no privileges on the target; the description ('enticing a victim or automated service to open the malicious content') implies the attacker needs no local account, so PR:H appears conservative/inconsistent and warrants vendor clarification. The vuln.today decision label is 'this_month' (not act_now or emergency), there is no CISA KEV listing, no EPSS score was supplied, and no PoC or exploit reference is present - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a genuine memory-corruption flaw with code-execution potential in a widely-used component, but the local vector plus required user interaction, the absence of exploitation signals, and the 'this_month' priority place it as a scheduled-patching item rather than an emergency. The A:N-vs-DoS and PR:H inconsistencies are the key data-quality caveats.

An attacker crafts a malicious TrueType font, or a document (e.g. PostScript/PDF) that embeds one, and delivers it to a target that uses Ghostscript for rendering or conversion - either a user who opens it or an automated document-processing service that ingests untrusted files. During font rendering an accounting error bypasses buffer size checks, overflowing a heap buffer and causing either a crash (DoS) or potential arbitrary code execution in the context of the processing component. No public exploit code or PoC reference is present in the supplied data.