Skip to content
OpenAdvisories
High ELSA-2026-83553 2 CVEs

Important: ghostscript security update (Oracle Linux 9)

Published Oct 15, 2026 · Updated Oct 15, 2026

Ecosystem: Oracle Linux

Summary

[9.54.0-19.3]
- RHEL-273957 CVE-2026-103226 ghostscript: ghostscript: stack-based
buffer overflow in pdfwrite via crafted font data

[9.54.0-19.2]
- CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free
via Type 5 shading OOB write and procedure-stream use-after-free

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 9 ghostscript 0:9.54.0-19.el9_8.3
Oracle Linux · 9 ghostscript-doc 0:9.54.0-19.el9_8.3
Oracle Linux · 9 ghostscript-tools-dvipdf 0:9.54.0-19.el9_8.3
Oracle Linux · 9 ghostscript-tools-fonts 0:9.54.0-19.el9_8.3
Oracle Linux · 9 ghostscript-tools-printing 0:9.54.0-19.el9_8.3
Oracle Linux · 9 ghostscript-x11 0:9.54.0-19.el9_8.3
Oracle Linux · 9 libgs 0:9.54.0-19.el9_8.3
Oracle Linux · 9 libgs-devel 0:9.54.0-19.el9_8.3

Vulnerabilities 2

  • High 7.8
    CVE-2026-101258

    Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

    A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document pa…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Medium 6.3
    CVE-2026-103226

    Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow

    A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the att…

    Artifex Ghostscript ghostscript ghostscript Debian Ubuntu