Ghostscript CVE-2026-112922

Exploitation requires an attacker to craft a PDF or PostScript document containing malicious mesh shading data with out-of-range indexed color values, and to entice a user (or an automated pipeline) to process that document with Ghostscript - the flaw is in the indexed-color bounds validation during mesh shading rendering. Limiting factors are significant: the CVSS vector is AV:L (Local) with UI:R, so a victim must actually open or process the attacker-supplied file; there is no network-service exposure and no privilege escalation. Impact is bounded to an application crash (DoS) or limited information disclosure, with no integrity impact.

All signals point to a low-priority issue. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 3.3) describes a local, user-interaction-dependent flaw with only limited confidentiality impact, and the vuln.today Decision label is 'monitor' - consistent with a low-severity finding. There is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or probable exploitation; no public exploit was identified at time of analysis. Two internal inconsistencies should be noted and verified: (1) the description calls the attacker 'remote' while the CVSS vector is AV:L (Local), reflecting the fact that exploitation actually occurs locally when a victim processes an attacker-supplied file - the 'remote' wording refers only to how the malicious document is delivered, not to a network-reachable service; and (2) the description states exploitation 'can lead to a Denial of Service through an application crash,' yet the supplied vector sets A:N (no availability impact), capturing only the C:L information-disclosure outcome - the availability half of the described impact is not reflected in the scored vector. Net: a genuinely low-risk, defense-in-depth-class bug, not an operational emergency.

An attacker crafts a PDF or PostScript file containing malicious mesh shading data with out-of-range indexed color values and sends it to a victim (e.g., as an email attachment or via a service that renders documents with Ghostscript). When the victim or a backend process opens the file, Ghostscript performs an out-of-bounds read while handling the indexed color values, crashing the application or leaking a limited amount of adjacent memory. No public exploit was identified at time of analysis, and the local vector plus required user interaction keep the attack opportunistic rather than scalable.