Ghostscript contains an out‑of‑bounds memory read in the shade_next_color function when it processes indexed color values in mesh shading. This flaw can cause the application to crash, resulting in a denial of service, or it can leak limited information from memory. The vulnerability is triggered by specially crafted PDF or PostScript documents that a malicious user can supply or persuade a victim to open.

The affected product is Ghostscript, the open‑source interpreter for PostScript and PDF. No specific version numbers are listed in the current advisory, so all installations that have not deployed the vendor’s fix are potentially vulnerable.

The CVSS score of 3.3 indicates low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, leveraging a malicious PDF or PostScript file that a user is induced to open or process. Successful exploitation would require the victim to run Ghostscript on the compromised document, which is feasible in many document handling scenarios.