Summary
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.
Security Fix(es):
* ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)
* ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | ghostscript | 9.27-19.el8_10 |
| AlmaLinux · 8 | ghostscript-doc | 9.27-19.el8_10 |
| AlmaLinux · 8 | ghostscript-tools-dvipdf | 9.27-19.el8_10 |
| AlmaLinux · 8 | ghostscript-tools-fonts | 9.27-19.el8_10 |
| AlmaLinux · 8 | ghostscript-tools-printing | 9.27-19.el8_10 |
| AlmaLinux · 8 | ghostscript-x11 | 9.27-19.el8_10 |
| AlmaLinux · 8 | libgs | 9.27-19.el8_10 |
| AlmaLinux · 8 | libgs-devel | 9.27-19.el8_10 |
Vulnerabilities 2
-
High 7.8
Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document pa…
-
Medium 6.3
Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the att…