VDB
RHSA-2026:83552
RHSA-2026:83552
PUBLISHED
CVSS 7.800000190734863 HIGH
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.
Risk Scores
CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | ghostscript-x11-0:9.27-19.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-gtk-debuginfo-0:9.27-19.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-x11-debuginfo-0:9.27-19.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-debuginfo-0:9.27-19.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-tools-fonts-0:9.27-19.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | libgs-debuginfo-0:9.27-19.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | libgs-debuginfo-0:9.27-19.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | libgs-debuginfo-0:9.27-19.el8_10.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-0:9.27-19.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | libgs-0:9.27-19.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-tools-dvipdf-0:9.27-19.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-debuginfo-0:9.27-19.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-x11-debuginfo-0:9.27-19.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-gtk-debuginfo-0:9.27-19.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-debuginfo-0:9.27-19.el8_10.s390x as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-doc-0:9.27-19.el8_10.noarch as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-0:9.27-19.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-debuginfo-0:9.27-19.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | libgs-devel-0:9.27-19.el8_10.i686 as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
| Red Hat | ghostscript-debugsource-0:9.27-19.el8_10.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8) | 0:9.27-19.el8_10 |
…and 62 more
Timeline
- Oct 15, 2026 CVE Published
- Oct 21, 2026 CVE Updated
- Oct 21, 2026 Distribution Patch
- Oct 21, 2026 Distribution Patch
- Oct 21, 2026 Security Advisory
- Oct 21, 2026 Security Advisory
- Oct 21, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:83552 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2542396 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2543939 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83552.json advisory
- https://access.redhat.com/security/cve/CVE-2026-101258 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-101258 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-101258 advisory
- https://github.com/v12-security/pocs/tree/main/ghostscript exploit
- https://access.redhat.com/security/cve/CVE-2026-103226 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-103226 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-103226 advisory
- https://artifex.com/ advisory
- https://bugs.ghostscript.com/attachment.cgi?id=28495 advisory
- https://bugs.ghostscript.com/show_bug.cgi?id=709672 advisory
- https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3 advisory
- https://vuldb.com/cve/CVE-2026-103226 advisory
- https://vuldb.com/submit/955016 advisory
- https://vuldb.com/vuln/411906 advisory
- https://vuldb.com/vuln/411906/cti advisory