Summary
Rick de Jager discovered that Ghostscript incorrectly handled memory
under certain circumstances when processing PostScript documents. If a
user or automated system were tricked into processing a specially crafted
document, an attacker could possibly use this issue to bypass the sandbox
and execute arbitrary code. (CVE-2026-101258)
It was discovered that Ghostscript incorrectly handled memory when
converting certain fonts. If a user or automated system were tricked into
processing a specially crafted file, an attacker could possibly use this
issue to cause Ghostscript to crash, or possibly execute arbitrary code.
(CVE-2026-103226)
Paulos Yibelo discovered that Ghostscript did not properly validate
certain operands when loading fonts. If a user or automated system were
tricked into processing a specially crafted file, an attacker could
possibly use this issue to bypass the sandbox and execute arbitrary code.
(No CVE number)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | ghostscript | 9.55.0~dfsg1-0ubuntu5.15 |
| Ubuntu · 24.04 LTS 24.04:LTS | ghostscript | 10.02.1~dfsg1-0ubuntu7.10 |
| Ubuntu · 26.04 LTS 26.04:LTS | ghostscript | 10.06.0~dfsg-3ubuntu1.2 |
| Ubuntu · 26.10 | ghostscript | 10.07.1~dfsg-1ubuntu2.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ghostscript | 9.26~dfsg+0-0ubuntu0.16.04.14+esm11 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ghostscript | 9.26~dfsg+0-0ubuntu0.18.04.18+esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ghostscript | 9.50~dfsg-5ubuntu4.15+esm3 |
Vulnerabilities 2
-
High 7.8
Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document pa…
-
Medium 6.3
Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the att…