{"id":"CVE-2026-101258","aliases":["ALSA-2026:83551","ALSA-2026:83552","ALSA-2026:83553","BELL-CVE-2026-101258","CLSA-2026-1792809195","CLSA-2026-1792809614","DEBIAN-CVE-2026-101258","EUVD-2026-93982","GHSA-g96p-c3cq-wp28","RHSA-2026:83551","RHSA-2026:83552","RHSA-2026:83553","RLSA-2026:83551","RLSA-2026:83552","RLSA-2026:83553","SUSE-SU-2026:24468-1","SUSE-SU-2026:5039-1","SUSE-SU-2026:5094-1","UBUNTU-CVE-2026-101258","USN-8949-1","openSUSE-SU-2026:12128-1","openSUSE-SU-2026:22176-1"],"status":"published","title":"Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free","description":"A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00179,"percentile":0.07487,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-10-06T20:02:24Z","modified":"2026-11-05T09:47:28Z","fixes":[{"ecosystem":"Alpaquita:23","package":"ghostscript","fixed_in":["10.01.2-r7"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"ghostscript","fixed_in":["10.05.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"ghostscript","fixed_in":["10.08.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-cups","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-doc","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-gtk","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libgs","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libgs-devel","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"ghostscript","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"ghostscript-cups","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"ghostscript-doc","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"ghostscript-gtk","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"libgs","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"libgs-devel","fixed_in":["9.25-5.0.1.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ghostscript","fixed_in":["10.05.1~dfsg-1+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["10.08.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","fixed_in":["9.26~dfsg+0-0ubuntu0.16.04.14+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ghostscript","fixed_in":["9.26~dfsg+0-0ubuntu0.18.04.18+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ghostscript","fixed_in":["9.50~dfsg-5ubuntu4.15+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ghostscript","fixed_in":["9.55.0~dfsg1-0ubuntu5.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","fixed_in":["10.02.1~dfsg1-0ubuntu7.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"ghostscript","fixed_in":["10.07.1~dfsg-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"ghostscript","fixed_in":["10.06.0~dfsg-3ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Alpaquita:23","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r0"},{"fixed":"10.01.2-r7"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.05.1-r0"},{"fixed":"10.05.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r0"},{"fixed":"10.08.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ghostscript-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0~dfsg-11","10.0.0~dfsg-11+deb12u1","10.0.0~dfsg-11+deb12u2","10.0.0~dfsg-11+deb12u3","10.0.0~dfsg-11+deb12u4","10.0.0~dfsg-11+deb12u5","10.0.0~dfsg-11+deb12u6","10.0.0~dfsg-11+deb12u7","10.0.0~dfsg-11+deb12u8","10.01.2~dfsg-1","10.02.0~dfsg-1","10.02.0~dfsg-2","10.02.1~dfsg-1","10.02.1~dfsg-2","10.02.1~dfsg-3","10.03.0~dfsg-1","10.03.1~dfsg-1","10.03.1~dfsg-2","10.03.1~dfsg~git20240518-1","10.04.0~dfsg-1","10.04.0~dfsg-2","10.05.0~dfsg-1","10.05.1~dfsg-1","10.05.1~dfsg-2","10.05.1~dfsg-3","10.06.0~dfsg-1","10.06.0~dfsg-2","10.06.0~dfsg-3","10.07.0~dfsg-1","10.07.0~dfsg-2","10.07.1~dfsg-1","10.08.0~dfsg-1","10.08.0~dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1~dfsg-1+deb13u3"}]}],"versions":["10.05.1~dfsg-1","10.05.1~dfsg-1+deb13u1","10.05.1~dfsg-1+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0~dfsg-1"}]}],"versions":["10.05.1~dfsg-1","10.05.1~dfsg-2","10.05.1~dfsg-3","10.06.0~dfsg-1","10.06.0~dfsg-2","10.06.0~dfsg-3","10.07.0~dfsg-1","10.07.0~dfsg-2","10.07.1~dfsg-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-23.103.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-23.103.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.16.04.14+esm11"}]}],"versions":["9.16~dfsg~0-0ubuntu3","9.16~dfsg~0-0ubuntu4","9.18~dfsg~0-0ubuntu1","9.18~dfsg~0-0ubuntu2","9.18~dfsg~0-0ubuntu2.2","9.18~dfsg~0-0ubuntu2.3","9.18~dfsg~0-0ubuntu2.4","9.18~dfsg~0-0ubuntu2.6","9.18~dfsg~0-0ubuntu2.7","9.18~dfsg~0-0ubuntu2.8","9.18~dfsg~0-0ubuntu2.9","9.25~dfsg+1-0ubuntu0.16.04.1","9.25~dfsg+1-0ubuntu0.16.04.2","9.25~dfsg+1-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.1","9.26~dfsg+0-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.4","9.26~dfsg+0-0ubuntu0.16.04.5","9.26~dfsg+0-0ubuntu0.16.04.6","9.26~dfsg+0-0ubuntu0.16.04.7","9.26~dfsg+0-0ubuntu0.16.04.8","9.26~dfsg+0-0ubuntu0.16.04.9","9.26~dfsg+0-0ubuntu0.16.04.10","9.26~dfsg+0-0ubuntu0.16.04.11","9.26~dfsg+0-0ubuntu0.16.04.12","9.26~dfsg+0-0ubuntu0.16.04.13","9.26~dfsg+0-0ubuntu0.16.04.14","9.26~dfsg+0-0ubuntu0.16.04.14+esm1","9.26~dfsg+0-0ubuntu0.16.04.14+esm2","9.26~dfsg+0-0ubuntu0.16.04.14+esm3","9.26~dfsg+0-0ubuntu0.16.04.14+esm4","9.26~dfsg+0-0ubuntu0.16.04.14+esm5","9.26~dfsg+0-0ubuntu0.16.04.14+esm6","9.26~dfsg+0-0ubuntu0.16.04.14+esm7","9.26~dfsg+0-0ubuntu0.16.04.14+esm8","9.26~dfsg+0-0ubuntu0.16.04.14+esm9","9.26~dfsg+0-0ubuntu0.16.04.14+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+esm6"}]}],"versions":["9.21~dfsg+1-0ubuntu3","9.22~dfsg+1-0ubuntu1","9.22~dfsg+1-0ubuntu1.1","9.22~dfsg+1-0ubuntu1.2","9.25~dfsg+1-0ubuntu0.18.04.1","9.25~dfsg+1-0ubuntu0.18.04.2","9.26~dfsg+0-0ubuntu0.18.04.1","9.26~dfsg+0-0ubuntu0.18.04.3","9.26~dfsg+0-0ubuntu0.18.04.4","9.26~dfsg+0-0ubuntu0.18.04.5","9.26~dfsg+0-0ubuntu0.18.04.6","9.26~dfsg+0-0ubuntu0.18.04.7","9.26~dfsg+0-0ubuntu0.18.04.8","9.26~dfsg+0-0ubuntu0.18.04.9","9.26~dfsg+0-0ubuntu0.18.04.10","9.26~dfsg+0-0ubuntu0.18.04.11","9.26~dfsg+0-0ubuntu0.18.04.12","9.26~dfsg+0-0ubuntu0.18.04.13","9.26~dfsg+0-0ubuntu0.18.04.14","9.26~dfsg+0-0ubuntu0.18.04.15","9.26~dfsg+0-0ubuntu0.18.04.16","9.26~dfsg+0-0ubuntu0.18.04.17","9.26~dfsg+0-0ubuntu0.18.04.18","9.26~dfsg+0-0ubuntu0.18.04.18+esm1","9.26~dfsg+0-0ubuntu0.18.04.18+esm2","9.26~dfsg+0-0ubuntu0.18.04.18+esm3","9.26~dfsg+0-0ubuntu0.18.04.18+esm4","9.26~dfsg+0-0ubuntu0.18.04.18+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.50~dfsg-5ubuntu4.15+esm3"}]}],"versions":["9.27~dfsg+0-0ubuntu3","9.27~dfsg+0-0ubuntu4","9.50~dfsg-5ubuntu1","9.50~dfsg-5ubuntu2","9.50~dfsg-5ubuntu3","9.50~dfsg-5ubuntu4","9.50~dfsg-5ubuntu4.1","9.50~dfsg-5ubuntu4.2","9.50~dfsg-5ubuntu4.3","9.50~dfsg-5ubuntu4.4","9.50~dfsg-5ubuntu4.5","9.50~dfsg-5ubuntu4.6","9.50~dfsg-5ubuntu4.7","9.50~dfsg-5ubuntu4.8","9.50~dfsg-5ubuntu4.9","9.50~dfsg-5ubuntu4.10","9.50~dfsg-5ubuntu4.11","9.50~dfsg-5ubuntu4.12","9.50~dfsg-5ubuntu4.13","9.50~dfsg-5ubuntu4.14","9.50~dfsg-5ubuntu4.15","9.50~dfsg-5ubuntu4.15+esm1","9.50~dfsg-5ubuntu4.15+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.55.0~dfsg1-0ubuntu5.15"}]}],"versions":["9.54.0~dfsg1-0ubuntu2","9.55.0~dfsg1-0ubuntu4","9.55.0~dfsg1-0ubuntu5","9.55.0~dfsg1-0ubuntu5.1","9.55.0~dfsg1-0ubuntu5.2","9.55.0~dfsg1-0ubuntu5.3","9.55.0~dfsg1-0ubuntu5.4","9.55.0~dfsg1-0ubuntu5.5","9.55.0~dfsg1-0ubuntu5.6","9.55.0~dfsg1-0ubuntu5.7","9.55.0~dfsg1-0ubuntu5.9","9.55.0~dfsg1-0ubuntu5.10","9.55.0~dfsg1-0ubuntu5.11","9.55.0~dfsg1-0ubuntu5.12","9.55.0~dfsg1-0ubuntu5.13","9.55.0~dfsg1-0ubuntu5.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1~dfsg1-0ubuntu7.10"}]}],"versions":["10.01.2~dfsg1-0ubuntu2","10.01.2~dfsg1-0ubuntu2.1","10.02.1~dfsg1-0ubuntu1","10.02.1~dfsg1-0ubuntu2","10.02.1~dfsg1-0ubuntu5","10.02.1~dfsg1-0ubuntu6","10.02.1~dfsg1-0ubuntu7","10.02.1~dfsg1-0ubuntu7.1","10.02.1~dfsg1-0ubuntu7.3","10.02.1~dfsg1-0ubuntu7.4","10.02.1~dfsg1-0ubuntu7.5","10.02.1~dfsg1-0ubuntu7.6","10.02.1~dfsg1-0ubuntu7.7","10.02.1~dfsg1-0ubuntu7.8","10.02.1~dfsg1-0ubuntu7.9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.07.1~dfsg-1ubuntu2.1"}]}],"versions":["10.06.0~dfsg-3ubuntu1","10.07.1~dfsg-1ubuntu1","10.07.1~dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0~dfsg-3ubuntu1.2"}]}],"versions":["10.05.0dfsg1-0ubuntu4","10.05.0dfsg1-0ubuntu5","10.06.0~dfsg-3ubuntu1","10.06.0~dfsg-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.16.04.14+esm11"}]}],"versions":["9.16~dfsg~0-0ubuntu3","9.16~dfsg~0-0ubuntu4","9.18~dfsg~0-0ubuntu1","9.18~dfsg~0-0ubuntu2","9.18~dfsg~0-0ubuntu2.2","9.18~dfsg~0-0ubuntu2.3","9.18~dfsg~0-0ubuntu2.4","9.18~dfsg~0-0ubuntu2.6","9.18~dfsg~0-0ubuntu2.7","9.18~dfsg~0-0ubuntu2.8","9.18~dfsg~0-0ubuntu2.9","9.25~dfsg+1-0ubuntu0.16.04.1","9.25~dfsg+1-0ubuntu0.16.04.2","9.25~dfsg+1-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.1","9.26~dfsg+0-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.4","9.26~dfsg+0-0ubuntu0.16.04.5","9.26~dfsg+0-0ubuntu0.16.04.6","9.26~dfsg+0-0ubuntu0.16.04.7","9.26~dfsg+0-0ubuntu0.16.04.8","9.26~dfsg+0-0ubuntu0.16.04.9","9.26~dfsg+0-0ubuntu0.16.04.10","9.26~dfsg+0-0ubuntu0.16.04.11","9.26~dfsg+0-0ubuntu0.16.04.12","9.26~dfsg+0-0ubuntu0.16.04.13","9.26~dfsg+0-0ubuntu0.16.04.14","9.26~dfsg+0-0ubuntu0.16.04.14+esm1","9.26~dfsg+0-0ubuntu0.16.04.14+esm2","9.26~dfsg+0-0ubuntu0.16.04.14+esm3","9.26~dfsg+0-0ubuntu0.16.04.14+esm4","9.26~dfsg+0-0ubuntu0.16.04.14+esm5","9.26~dfsg+0-0ubuntu0.16.04.14+esm6","9.26~dfsg+0-0ubuntu0.16.04.14+esm7","9.26~dfsg+0-0ubuntu0.16.04.14+esm8","9.26~dfsg+0-0ubuntu0.16.04.14+esm9","9.26~dfsg+0-0ubuntu0.16.04.14+esm10"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+esm6"}]}],"versions":["9.21~dfsg+1-0ubuntu3","9.22~dfsg+1-0ubuntu1","9.22~dfsg+1-0ubuntu1.1","9.22~dfsg+1-0ubuntu1.2","9.25~dfsg+1-0ubuntu0.18.04.1","9.25~dfsg+1-0ubuntu0.18.04.2","9.26~dfsg+0-0ubuntu0.18.04.1","9.26~dfsg+0-0ubuntu0.18.04.3","9.26~dfsg+0-0ubuntu0.18.04.4","9.26~dfsg+0-0ubuntu0.18.04.5","9.26~dfsg+0-0ubuntu0.18.04.6","9.26~dfsg+0-0ubuntu0.18.04.7","9.26~dfsg+0-0ubuntu0.18.04.8","9.26~dfsg+0-0ubuntu0.18.04.9","9.26~dfsg+0-0ubuntu0.18.04.10","9.26~dfsg+0-0ubuntu0.18.04.11","9.26~dfsg+0-0ubuntu0.18.04.12","9.26~dfsg+0-0ubuntu0.18.04.13","9.26~dfsg+0-0ubuntu0.18.04.14","9.26~dfsg+0-0ubuntu0.18.04.15","9.26~dfsg+0-0ubuntu0.18.04.16","9.26~dfsg+0-0ubuntu0.18.04.17","9.26~dfsg+0-0ubuntu0.18.04.18","9.26~dfsg+0-0ubuntu0.18.04.18+esm1","9.26~dfsg+0-0ubuntu0.18.04.18+esm2","9.26~dfsg+0-0ubuntu0.18.04.18+esm3","9.26~dfsg+0-0ubuntu0.18.04.18+esm4","9.26~dfsg+0-0ubuntu0.18.04.18+esm5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.50~dfsg-5ubuntu4.15+esm3"}]}],"versions":["9.27~dfsg+0-0ubuntu3","9.27~dfsg+0-0ubuntu4","9.50~dfsg-5ubuntu1","9.50~dfsg-5ubuntu2","9.50~dfsg-5ubuntu3","9.50~dfsg-5ubuntu4","9.50~dfsg-5ubuntu4.1","9.50~dfsg-5ubuntu4.2","9.50~dfsg-5ubuntu4.3","9.50~dfsg-5ubuntu4.4","9.50~dfsg-5ubuntu4.5","9.50~dfsg-5ubuntu4.6","9.50~dfsg-5ubuntu4.7","9.50~dfsg-5ubuntu4.8","9.50~dfsg-5ubuntu4.9","9.50~dfsg-5ubuntu4.10","9.50~dfsg-5ubuntu4.11","9.50~dfsg-5ubuntu4.12","9.50~dfsg-5ubuntu4.13","9.50~dfsg-5ubuntu4.14","9.50~dfsg-5ubuntu4.15","9.50~dfsg-5ubuntu4.15+esm1","9.50~dfsg-5ubuntu4.15+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.55.0~dfsg1-0ubuntu5.15"}]}],"versions":["9.54.0~dfsg1-0ubuntu2","9.55.0~dfsg1-0ubuntu4","9.55.0~dfsg1-0ubuntu5","9.55.0~dfsg1-0ubuntu5.1","9.55.0~dfsg1-0ubuntu5.2","9.55.0~dfsg1-0ubuntu5.3","9.55.0~dfsg1-0ubuntu5.4","9.55.0~dfsg1-0ubuntu5.5","9.55.0~dfsg1-0ubuntu5.6","9.55.0~dfsg1-0ubuntu5.7","9.55.0~dfsg1-0ubuntu5.9","9.55.0~dfsg1-0ubuntu5.10","9.55.0~dfsg1-0ubuntu5.11","9.55.0~dfsg1-0ubuntu5.12","9.55.0~dfsg1-0ubuntu5.13","9.55.0~dfsg1-0ubuntu5.14"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1~dfsg1-0ubuntu7.10"}]}],"versions":["10.01.2~dfsg1-0ubuntu2","10.01.2~dfsg1-0ubuntu2.1","10.02.1~dfsg1-0ubuntu1","10.02.1~dfsg1-0ubuntu2","10.02.1~dfsg1-0ubuntu5","10.02.1~dfsg1-0ubuntu6","10.02.1~dfsg1-0ubuntu7","10.02.1~dfsg1-0ubuntu7.1","10.02.1~dfsg1-0ubuntu7.3","10.02.1~dfsg1-0ubuntu7.4","10.02.1~dfsg1-0ubuntu7.5","10.02.1~dfsg1-0ubuntu7.6","10.02.1~dfsg1-0ubuntu7.7","10.02.1~dfsg1-0ubuntu7.8","10.02.1~dfsg1-0ubuntu7.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.07.1~dfsg-1ubuntu2.1"}]}],"versions":["10.06.0~dfsg-3ubuntu1","10.07.1~dfsg-1ubuntu1","10.07.1~dfsg-1ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0~dfsg-3ubuntu1.2"}]}],"versions":["10.05.0dfsg1-0ubuntu4","10.05.0dfsg1-0ubuntu5","10.06.0~dfsg-3ubuntu1","10.06.0~dfsg-3ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-160000.2.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:83551","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83552","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83553","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101258","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542396","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/v12-security/pocs/tree/main/ghostscript","tags":["article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101258","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g96p-c3cq-wp28"},{"url":"https://access.redhat.com/security/cve/CVE-2026-103226","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542396","tags":["report"]},{"url":"https://bugzilla.redhat.com/2543939","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-83551.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-83552.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-83553.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-101258","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792809195.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792809614.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-101258","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543939","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83551.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101258","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103226","tags":["advisory"]},{"url":"https://artifex.com/","tags":["article"]},{"url":"https://bugs.ghostscript.com/attachment.cgi?id=28495","tags":["article"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709672","tags":["article"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3","tags":["article"]},{"url":"https://vuldb.com/cve/CVE-2026-103226","tags":["article"]},{"url":"https://vuldb.com/submit/955016","tags":["article"]},{"url":"https://vuldb.com/vuln/411906","tags":["article"]},{"url":"https://vuldb.com/vuln/411906/cti","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83552.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83553.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:83551","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:83552","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:83553","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624468-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283917","tags":["report"]},{"url":"https://bugzilla.suse.com/1284397","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-101258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-103226","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265039-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265094-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-101258","tags":["report"]},{"url":"https://github.com/v12-security/pocs/blob/main/ghostscript/REPORT.md","tags":["report"]},{"url":"https://www.debian.org/security/2026/dsa-6550","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8949-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-103226","tags":["report"]},{"url":"https://bugs.launchpad.net/bugs/2171528","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-101258","title":"Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free","description":"A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.","status":"published","published":"2026-10-06T20:02:24.398Z","modified":"2026-11-04T21:43:31.186Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2026-93982","description":"A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.","status":"published","published":"2026-10-06T20:02:24Z","modified":"2026-11-04T21:43:31Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T23:47:19.24864Z"}],"ghsa":[{"id":"GHSA-g96p-c3cq-wp28","title":"A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document,...","description":"A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.","status":"published","published":"2026-10-06T21:32:03Z","modified":"2026-10-15T18:32:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:13:37.004212Z"}],"nvd":[{"id":"CVE-2026-101258","description":"A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.","status":"published","published":"2026-10-06T21:17:02.12Z","modified":"2026-11-04T22:17:42.67Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-04T23:43:40.301794Z"}],"osv":[{"id":"BELL-CVE-2026-101258","status":"published","published":"2026-10-07T06:05:19.362836Z","modified":"2026-11-04T07:15:56.021826899Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T07:31:49.594962Z"},{"id":"DEBIAN-CVE-2026-101258","description":"A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.","status":"published","published":"2026-10-06T21:17:02.12Z","modified":"2026-11-05T09:47:28.270450037Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:49.170436Z"},{"id":"RHSA-2026:83551","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2026-10-16T10:27:28Z","modified":"2026-10-20T10:17:16Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:83552","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2026-10-16T10:27:28Z","modified":"2026-10-20T10:17:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:83553","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2026-10-16T10:27:29Z","modified":"2026-10-20T10:17:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:83551","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n\n* ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-16T12:10:48.882476Z","modified":"2026-10-16T12:45:03.613653655Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:83552","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n\n* ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-16T12:01:37.029289Z","modified":"2026-10-16T12:45:02.618264084Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:83553","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n\n* ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-16T12:05:26.574296Z","modified":"2026-10-16T12:45:03.605326512Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-101258","description":"A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.","status":"published","published":"2026-10-06T21:17:00Z","modified":"2026-10-22T23:19:38.827237738Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"ALSA-2026:83551","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n  * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-29T11:31:01.714265524Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:83552","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n  * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-29T11:02:25.165045435Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:83553","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n  * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-29T11:32:38.256873505Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1792809195","title":"ghostscript: Fix of CVE-2026-101258","description":"- CVE-2026-101258: fix -dSAFER bypass via shading function OOB write\n  and procedural filter use-after-free","status":"published","published":"2026-10-24T16:54:06Z","modified":"2026-10-26T09:31:57.408702214Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792809614","title":"ghostscript: Fix of CVE-2026-101258","description":"- CVE-2026-101258: fix -dSAFER bypass via shading function OOB write\n  and procedural filter use-after-free","status":"published","published":"2026-10-24T02:40:24Z","modified":"2026-10-26T09:32:01.51012976Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12128-1","title":"ghostscript-10.08.0-2.1 on GA media","description":"These are all security issues fixed in the ghostscript-10.08.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-14T00:00:00Z","modified":"2026-10-15T17:23:12.976749716Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22176-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free\n  (bsc#1284397).\n- CVE-2026-103226: stack-based buffer overflow in `pdfwrite` via crafted font data (bsc#1283917).\n","status":"published","published":"2026-10-27T14:35:50Z","modified":"2026-11-01T17:23:29.417069619Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24468-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free\n  (bsc#1284397).\n- CVE-2026-103226: stack-based buffer overflow in `pdfwrite` via crafted font data (bsc#1283917).\n","status":"published","published":"2026-10-27T14:35:51Z","modified":"2026-11-04T17:23:17.641005127Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:5039-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free\n  (bsc#1284397).\n- CVE-2026-103226: stack-based buffer overflow in `pdfwrite` via crafted font data (bsc#1283917).\n","status":"published","published":"2026-11-02T16:23:54Z","modified":"2026-11-03T13:15:08.785916628Z","updated_at":"2026-11-03T13:33:04.521148Z"},{"id":"SUSE-SU-2026:5094-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free\n  (bsc#1284397).\n- CVE-2026-103226: stack-based buffer overflow in `pdfwrite` via crafted font data (bsc#1283917).\n","status":"published","published":"2026-11-04T08:16:20Z","modified":"2026-11-04T23:00:26.609709935Z","updated_at":"2026-11-04T23:09:59.08306Z"},{"id":"USN-8949-1","title":"ghostscript vulnerabilities","description":"Rick de Jager discovered that Ghostscript incorrectly handled memory\nunder certain circumstances when processing PostScript documents. If a\nuser or automated system were tricked into processing a specially crafted\ndocument, an attacker could possibly use this issue to bypass the sandbox\nand execute arbitrary code. (CVE-2026-101258)\n\nIt was discovered that Ghostscript incorrectly handled memory when\nconverting certain fonts. If a user or automated system were tricked into\nprocessing a specially crafted file, an attacker could possibly use this\nissue to cause Ghostscript to crash, or possibly execute arbitrary code.\n(CVE-2026-103226)\n\nPaulos Yibelo discovered that Ghostscript did not properly validate\ncertain operands when loading fonts. If a user or automated system were\ntricked into processing a specially crafted file, an attacker could\npossibly use this issue to bypass the sandbox and execute arbitrary code.\n(No CVE number)","status":"published","published":"2026-10-21T15:39:32Z","modified":"2026-10-22T23:27:00.207345393Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}