Ghostscript Out-of-Bounds Memory Flaws

Heap-based buffer overflow in Ghostscript's TrueType font rendering path lets an attacker crash the interpreter or potentially execute code by getting a crafted font - or a document embedding one - processed on the target host. The flaw is reachable whenever Ghostscript renders untrusted content, so automated document-conversion, print-filter and preview pipelines that ingest attacker-supplied files are the realistic exposure; the malicious file must reach and be parsed locally (AV:L) and the victim or service must open or render it (UI:R), while no authentication is required under the assessed vector. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so urgency is moderate and ties to patch availability rather than active exploitation; the supplied base score of 5.8 understates the assessed vector, which adds PR:N and A:H and raises the effective severity.

An out-of-bounds memory read in Ghostscript's mesh shading renderer lets an attacker who supplies a crafted PDF or PostScript document cause the interpreter to crash or leak a small amount of adjacent memory. The flaw sits in the handling of indexed color values inside mesh shading data, where bounds validation is incomplete; Ghostscript builds shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as the affected packages, so any user or automated pipeline rendering untrusted documents with those builds is exposed to the crash path. The assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.3), meaning a victim must actually open or process the malicious file; there is no network-service exposure and no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so prioritization is monitor.