{"id":"CVE-2026-103226","aliases":["ALSA-2026:83551","ALSA-2026:83552","ALSA-2026:83553","CLSA-2026-1791294114","CLSA-2026-1791463004","DEBIAN-CVE-2026-103226","EUVD-2026-89962","GHSA-f9vm-qh24-w7rf","RHSA-2026:83551","RHSA-2026:83552","RHSA-2026:83553","RLSA-2026:83551","RLSA-2026:83552","RLSA-2026:83553","SUSE-SU-2026:24468-1","SUSE-SU-2026:5039-1","SUSE-SU-2026:5094-1","UBUNTU-CVE-2026-103226","USN-8949-1","openSUSE-SU-2026:12128-1","openSUSE-SU-2026:22176-1"],"status":"published","title":"Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow","description":"A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\"","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00319,"percentile":0.25145,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-121"],"published":"2026-09-30T14:15:06Z","modified":"2026-11-04T23:00:26Z","fixes":[{"ecosystem":"Debian:13","package":"ghostscript","fixed_in":["10.05.1~dfsg-1+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["10.08.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","fixed_in":["9.26~dfsg+0-0ubuntu0.16.04.14+esm11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ghostscript","fixed_in":["9.26~dfsg+0-0ubuntu0.18.04.18+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ghostscript","fixed_in":["9.50~dfsg-5ubuntu4.15+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ghostscript","fixed_in":["9.55.0~dfsg1-0ubuntu5.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","fixed_in":["10.02.1~dfsg1-0ubuntu7.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"ghostscript","fixed_in":["10.07.1~dfsg-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"ghostscript","fixed_in":["10.06.0~dfsg-3ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0~dfsg-11","10.0.0~dfsg-11+deb12u1","10.0.0~dfsg-11+deb12u2","10.0.0~dfsg-11+deb12u3","10.0.0~dfsg-11+deb12u4","10.0.0~dfsg-11+deb12u5","10.0.0~dfsg-11+deb12u6","10.0.0~dfsg-11+deb12u7","10.0.0~dfsg-11+deb12u8","10.01.2~dfsg-1","10.02.0~dfsg-1","10.02.0~dfsg-2","10.02.1~dfsg-1","10.02.1~dfsg-2","10.02.1~dfsg-3","10.03.0~dfsg-1","10.03.1~dfsg-1","10.03.1~dfsg-2","10.03.1~dfsg~git20240518-1","10.04.0~dfsg-1","10.04.0~dfsg-2","10.05.0~dfsg-1","10.05.1~dfsg-1","10.05.1~dfsg-2","10.05.1~dfsg-3","10.06.0~dfsg-1","10.06.0~dfsg-2","10.06.0~dfsg-3","10.07.0~dfsg-1","10.07.0~dfsg-2","10.07.1~dfsg-1","10.08.0~dfsg-1","10.08.0~dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1~dfsg-1+deb13u3"}]}],"versions":["10.05.1~dfsg-1","10.05.1~dfsg-1+deb13u1","10.05.1~dfsg-1+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0~dfsg-1"}]}],"versions":["10.05.1~dfsg-1","10.05.1~dfsg-2","10.05.1~dfsg-3","10.06.0~dfsg-1","10.06.0~dfsg-2","10.06.0~dfsg-3","10.07.0~dfsg-1","10.07.0~dfsg-2","10.07.1~dfsg-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.02.1-16.el10_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-19.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-160000.2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.217.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-23.103.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-23.103.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.16.04.14+esm11"}]}],"versions":["9.16~dfsg~0-0ubuntu3","9.16~dfsg~0-0ubuntu4","9.18~dfsg~0-0ubuntu1","9.18~dfsg~0-0ubuntu2","9.18~dfsg~0-0ubuntu2.2","9.18~dfsg~0-0ubuntu2.3","9.18~dfsg~0-0ubuntu2.4","9.18~dfsg~0-0ubuntu2.6","9.18~dfsg~0-0ubuntu2.7","9.18~dfsg~0-0ubuntu2.8","9.18~dfsg~0-0ubuntu2.9","9.25~dfsg+1-0ubuntu0.16.04.1","9.25~dfsg+1-0ubuntu0.16.04.2","9.25~dfsg+1-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.1","9.26~dfsg+0-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.4","9.26~dfsg+0-0ubuntu0.16.04.5","9.26~dfsg+0-0ubuntu0.16.04.6","9.26~dfsg+0-0ubuntu0.16.04.7","9.26~dfsg+0-0ubuntu0.16.04.8","9.26~dfsg+0-0ubuntu0.16.04.9","9.26~dfsg+0-0ubuntu0.16.04.10","9.26~dfsg+0-0ubuntu0.16.04.11","9.26~dfsg+0-0ubuntu0.16.04.12","9.26~dfsg+0-0ubuntu0.16.04.13","9.26~dfsg+0-0ubuntu0.16.04.14","9.26~dfsg+0-0ubuntu0.16.04.14+esm1","9.26~dfsg+0-0ubuntu0.16.04.14+esm2","9.26~dfsg+0-0ubuntu0.16.04.14+esm3","9.26~dfsg+0-0ubuntu0.16.04.14+esm4","9.26~dfsg+0-0ubuntu0.16.04.14+esm5","9.26~dfsg+0-0ubuntu0.16.04.14+esm6","9.26~dfsg+0-0ubuntu0.16.04.14+esm7","9.26~dfsg+0-0ubuntu0.16.04.14+esm8","9.26~dfsg+0-0ubuntu0.16.04.14+esm9","9.26~dfsg+0-0ubuntu0.16.04.14+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+esm6"}]}],"versions":["9.21~dfsg+1-0ubuntu3","9.22~dfsg+1-0ubuntu1","9.22~dfsg+1-0ubuntu1.1","9.22~dfsg+1-0ubuntu1.2","9.25~dfsg+1-0ubuntu0.18.04.1","9.25~dfsg+1-0ubuntu0.18.04.2","9.26~dfsg+0-0ubuntu0.18.04.1","9.26~dfsg+0-0ubuntu0.18.04.3","9.26~dfsg+0-0ubuntu0.18.04.4","9.26~dfsg+0-0ubuntu0.18.04.5","9.26~dfsg+0-0ubuntu0.18.04.6","9.26~dfsg+0-0ubuntu0.18.04.7","9.26~dfsg+0-0ubuntu0.18.04.8","9.26~dfsg+0-0ubuntu0.18.04.9","9.26~dfsg+0-0ubuntu0.18.04.10","9.26~dfsg+0-0ubuntu0.18.04.11","9.26~dfsg+0-0ubuntu0.18.04.12","9.26~dfsg+0-0ubuntu0.18.04.13","9.26~dfsg+0-0ubuntu0.18.04.14","9.26~dfsg+0-0ubuntu0.18.04.15","9.26~dfsg+0-0ubuntu0.18.04.16","9.26~dfsg+0-0ubuntu0.18.04.17","9.26~dfsg+0-0ubuntu0.18.04.18","9.26~dfsg+0-0ubuntu0.18.04.18+esm1","9.26~dfsg+0-0ubuntu0.18.04.18+esm2","9.26~dfsg+0-0ubuntu0.18.04.18+esm3","9.26~dfsg+0-0ubuntu0.18.04.18+esm4","9.26~dfsg+0-0ubuntu0.18.04.18+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.50~dfsg-5ubuntu4.15+esm3"}]}],"versions":["9.27~dfsg+0-0ubuntu3","9.27~dfsg+0-0ubuntu4","9.50~dfsg-5ubuntu1","9.50~dfsg-5ubuntu2","9.50~dfsg-5ubuntu3","9.50~dfsg-5ubuntu4","9.50~dfsg-5ubuntu4.1","9.50~dfsg-5ubuntu4.2","9.50~dfsg-5ubuntu4.3","9.50~dfsg-5ubuntu4.4","9.50~dfsg-5ubuntu4.5","9.50~dfsg-5ubuntu4.6","9.50~dfsg-5ubuntu4.7","9.50~dfsg-5ubuntu4.8","9.50~dfsg-5ubuntu4.9","9.50~dfsg-5ubuntu4.10","9.50~dfsg-5ubuntu4.11","9.50~dfsg-5ubuntu4.12","9.50~dfsg-5ubuntu4.13","9.50~dfsg-5ubuntu4.14","9.50~dfsg-5ubuntu4.15","9.50~dfsg-5ubuntu4.15+esm1","9.50~dfsg-5ubuntu4.15+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.55.0~dfsg1-0ubuntu5.15"}]}],"versions":["9.54.0~dfsg1-0ubuntu2","9.55.0~dfsg1-0ubuntu4","9.55.0~dfsg1-0ubuntu5","9.55.0~dfsg1-0ubuntu5.1","9.55.0~dfsg1-0ubuntu5.2","9.55.0~dfsg1-0ubuntu5.3","9.55.0~dfsg1-0ubuntu5.4","9.55.0~dfsg1-0ubuntu5.5","9.55.0~dfsg1-0ubuntu5.6","9.55.0~dfsg1-0ubuntu5.7","9.55.0~dfsg1-0ubuntu5.9","9.55.0~dfsg1-0ubuntu5.10","9.55.0~dfsg1-0ubuntu5.11","9.55.0~dfsg1-0ubuntu5.12","9.55.0~dfsg1-0ubuntu5.13","9.55.0~dfsg1-0ubuntu5.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1~dfsg1-0ubuntu7.10"}]}],"versions":["10.01.2~dfsg1-0ubuntu2","10.01.2~dfsg1-0ubuntu2.1","10.02.1~dfsg1-0ubuntu1","10.02.1~dfsg1-0ubuntu2","10.02.1~dfsg1-0ubuntu5","10.02.1~dfsg1-0ubuntu6","10.02.1~dfsg1-0ubuntu7","10.02.1~dfsg1-0ubuntu7.1","10.02.1~dfsg1-0ubuntu7.3","10.02.1~dfsg1-0ubuntu7.4","10.02.1~dfsg1-0ubuntu7.5","10.02.1~dfsg1-0ubuntu7.6","10.02.1~dfsg1-0ubuntu7.7","10.02.1~dfsg1-0ubuntu7.8","10.02.1~dfsg1-0ubuntu7.9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.07.1~dfsg-1ubuntu2.1"}]}],"versions":["10.06.0~dfsg-3ubuntu1","10.07.1~dfsg-1ubuntu1","10.07.1~dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0~dfsg-3ubuntu1.2"}]}],"versions":["10.05.0dfsg1-0ubuntu4","10.05.0dfsg1-0ubuntu5","10.06.0~dfsg-3ubuntu1","10.06.0~dfsg-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.16.04.14+esm11"}]}],"versions":["9.16~dfsg~0-0ubuntu3","9.16~dfsg~0-0ubuntu4","9.18~dfsg~0-0ubuntu1","9.18~dfsg~0-0ubuntu2","9.18~dfsg~0-0ubuntu2.2","9.18~dfsg~0-0ubuntu2.3","9.18~dfsg~0-0ubuntu2.4","9.18~dfsg~0-0ubuntu2.6","9.18~dfsg~0-0ubuntu2.7","9.18~dfsg~0-0ubuntu2.8","9.18~dfsg~0-0ubuntu2.9","9.25~dfsg+1-0ubuntu0.16.04.1","9.25~dfsg+1-0ubuntu0.16.04.2","9.25~dfsg+1-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.1","9.26~dfsg+0-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.4","9.26~dfsg+0-0ubuntu0.16.04.5","9.26~dfsg+0-0ubuntu0.16.04.6","9.26~dfsg+0-0ubuntu0.16.04.7","9.26~dfsg+0-0ubuntu0.16.04.8","9.26~dfsg+0-0ubuntu0.16.04.9","9.26~dfsg+0-0ubuntu0.16.04.10","9.26~dfsg+0-0ubuntu0.16.04.11","9.26~dfsg+0-0ubuntu0.16.04.12","9.26~dfsg+0-0ubuntu0.16.04.13","9.26~dfsg+0-0ubuntu0.16.04.14","9.26~dfsg+0-0ubuntu0.16.04.14+esm1","9.26~dfsg+0-0ubuntu0.16.04.14+esm2","9.26~dfsg+0-0ubuntu0.16.04.14+esm3","9.26~dfsg+0-0ubuntu0.16.04.14+esm4","9.26~dfsg+0-0ubuntu0.16.04.14+esm5","9.26~dfsg+0-0ubuntu0.16.04.14+esm6","9.26~dfsg+0-0ubuntu0.16.04.14+esm7","9.26~dfsg+0-0ubuntu0.16.04.14+esm8","9.26~dfsg+0-0ubuntu0.16.04.14+esm9","9.26~dfsg+0-0ubuntu0.16.04.14+esm10"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+esm6"}]}],"versions":["9.21~dfsg+1-0ubuntu3","9.22~dfsg+1-0ubuntu1","9.22~dfsg+1-0ubuntu1.1","9.22~dfsg+1-0ubuntu1.2","9.25~dfsg+1-0ubuntu0.18.04.1","9.25~dfsg+1-0ubuntu0.18.04.2","9.26~dfsg+0-0ubuntu0.18.04.1","9.26~dfsg+0-0ubuntu0.18.04.3","9.26~dfsg+0-0ubuntu0.18.04.4","9.26~dfsg+0-0ubuntu0.18.04.5","9.26~dfsg+0-0ubuntu0.18.04.6","9.26~dfsg+0-0ubuntu0.18.04.7","9.26~dfsg+0-0ubuntu0.18.04.8","9.26~dfsg+0-0ubuntu0.18.04.9","9.26~dfsg+0-0ubuntu0.18.04.10","9.26~dfsg+0-0ubuntu0.18.04.11","9.26~dfsg+0-0ubuntu0.18.04.12","9.26~dfsg+0-0ubuntu0.18.04.13","9.26~dfsg+0-0ubuntu0.18.04.14","9.26~dfsg+0-0ubuntu0.18.04.15","9.26~dfsg+0-0ubuntu0.18.04.16","9.26~dfsg+0-0ubuntu0.18.04.17","9.26~dfsg+0-0ubuntu0.18.04.18","9.26~dfsg+0-0ubuntu0.18.04.18+esm1","9.26~dfsg+0-0ubuntu0.18.04.18+esm2","9.26~dfsg+0-0ubuntu0.18.04.18+esm3","9.26~dfsg+0-0ubuntu0.18.04.18+esm4","9.26~dfsg+0-0ubuntu0.18.04.18+esm5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.50~dfsg-5ubuntu4.15+esm3"}]}],"versions":["9.27~dfsg+0-0ubuntu3","9.27~dfsg+0-0ubuntu4","9.50~dfsg-5ubuntu1","9.50~dfsg-5ubuntu2","9.50~dfsg-5ubuntu3","9.50~dfsg-5ubuntu4","9.50~dfsg-5ubuntu4.1","9.50~dfsg-5ubuntu4.2","9.50~dfsg-5ubuntu4.3","9.50~dfsg-5ubuntu4.4","9.50~dfsg-5ubuntu4.5","9.50~dfsg-5ubuntu4.6","9.50~dfsg-5ubuntu4.7","9.50~dfsg-5ubuntu4.8","9.50~dfsg-5ubuntu4.9","9.50~dfsg-5ubuntu4.10","9.50~dfsg-5ubuntu4.11","9.50~dfsg-5ubuntu4.12","9.50~dfsg-5ubuntu4.13","9.50~dfsg-5ubuntu4.14","9.50~dfsg-5ubuntu4.15","9.50~dfsg-5ubuntu4.15+esm1","9.50~dfsg-5ubuntu4.15+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.55.0~dfsg1-0ubuntu5.15"}]}],"versions":["9.54.0~dfsg1-0ubuntu2","9.55.0~dfsg1-0ubuntu4","9.55.0~dfsg1-0ubuntu5","9.55.0~dfsg1-0ubuntu5.1","9.55.0~dfsg1-0ubuntu5.2","9.55.0~dfsg1-0ubuntu5.3","9.55.0~dfsg1-0ubuntu5.4","9.55.0~dfsg1-0ubuntu5.5","9.55.0~dfsg1-0ubuntu5.6","9.55.0~dfsg1-0ubuntu5.7","9.55.0~dfsg1-0ubuntu5.9","9.55.0~dfsg1-0ubuntu5.10","9.55.0~dfsg1-0ubuntu5.11","9.55.0~dfsg1-0ubuntu5.12","9.55.0~dfsg1-0ubuntu5.13","9.55.0~dfsg1-0ubuntu5.14"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1~dfsg1-0ubuntu7.10"}]}],"versions":["10.01.2~dfsg1-0ubuntu2","10.01.2~dfsg1-0ubuntu2.1","10.02.1~dfsg1-0ubuntu1","10.02.1~dfsg1-0ubuntu2","10.02.1~dfsg1-0ubuntu5","10.02.1~dfsg1-0ubuntu6","10.02.1~dfsg1-0ubuntu7","10.02.1~dfsg1-0ubuntu7.1","10.02.1~dfsg1-0ubuntu7.3","10.02.1~dfsg1-0ubuntu7.4","10.02.1~dfsg1-0ubuntu7.5","10.02.1~dfsg1-0ubuntu7.6","10.02.1~dfsg1-0ubuntu7.7","10.02.1~dfsg1-0ubuntu7.8","10.02.1~dfsg1-0ubuntu7.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.07.1~dfsg-1ubuntu2.1"}]}],"versions":["10.06.0~dfsg-3ubuntu1","10.07.1~dfsg-1ubuntu1","10.07.1~dfsg-1ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0~dfsg-3ubuntu1.2"}]}],"versions":["10.05.0dfsg1-0ubuntu4","10.05.0dfsg1-0ubuntu5","10.06.0~dfsg-3ubuntu1","10.06.0~dfsg-3ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-160000.2.1"}]}],"bundled":2}],"products":[{"vendor":"artifex","product":"ghostscript"}],"references":[{"url":"https://vuldb.com/vuln/411906","tags":["vdb-entry","technical-description","article","report"]},{"url":"https://vuldb.com/vuln/411906/cti","tags":["signature","permissions-required","article","report"]},{"url":"https://vuldb.com/cve/CVE-2026-103226","tags":["third-party-advisory","article","report"]},{"url":"https://vuldb.com/submit/955016","tags":["third-party-advisory","article","report"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709672","tags":["issue-tracking","article","report"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3","tags":["issue-tracking","article"]},{"url":"https://bugs.ghostscript.com/attachment.cgi?id=28495","tags":["exploit","article"]},{"url":"https://ghostscript.com/releases/gsdnld.html","tags":["patch"]},{"url":"https://artifex.com/","tags":["product","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103226","tags":["advisory"]},{"url":"https://artifex.com"},{"url":"https://github.com/advisories/GHSA-f9vm-qh24-w7rf"},{"url":"https://access.redhat.com/errata/RHSA-2026:83551","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101258","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-103226","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542396","tags":["report"]},{"url":"https://bugzilla.redhat.com/2543939","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-83551.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83552","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-83552.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83553","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-83553.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791294114.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39919","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791463004.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46646","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-103226","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543939","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83551.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101258","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101258","tags":["advisory"]},{"url":"https://github.com/v12-security/pocs/tree/main/ghostscript","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103226","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83552.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83553.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:83551","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:83552","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:83553","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624468-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283917","tags":["report"]},{"url":"https://bugzilla.suse.com/1284397","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-101258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-103226","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265039-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265094-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-103226","tags":["report"]},{"url":"https://www.debian.org/security/2026/dsa-6550","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8949-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-101258","tags":["report"]},{"url":"https://bugs.launchpad.net/bugs/2171528","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-103226","title":"Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow","description":"A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\"","status":"published","published":"2026-09-30T14:15:06.241Z","modified":"2026-10-15T16:16:29.137Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-121","CWE-119"],"updated_at":"2026-11-02T13:34:48.658051Z"}],"euvd":[{"id":"EUVD-2026-89962","description":"A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\"","status":"published","published":"2026-09-30T14:15:06Z","modified":"2026-10-15T16:16:29Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T17:00:12.42385Z"}],"ghsa":[{"id":"GHSA-f9vm-qh24-w7rf","title":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function...","description":"A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\"","status":"published","published":"2026-09-30T15:31:34Z","modified":"2026-10-15T18:32:44Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:13:37.004212Z"}],"nvd":[{"id":"CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\"","status":"published","published":"2026-09-30T15:22:25.663Z","modified":"2026-10-15T17:17:10.48Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-121"],"updated_at":"2026-11-02T14:12:53.097633Z"}],"osv":[{"id":"DEBIAN-CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\"","status":"published","published":"2026-09-30T15:22:25.663Z","modified":"2026-10-16T10:01:37.229924156Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"RHSA-2026:83551","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2026-10-16T10:27:28Z","modified":"2026-10-20T10:17:16Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:83552","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2026-10-16T10:27:28Z","modified":"2026-10-20T10:17:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:83553","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2026-10-16T10:27:29Z","modified":"2026-10-20T10:17:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:83551","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n\n* ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-16T12:10:48.882476Z","modified":"2026-10-16T12:45:03.613653655Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:83552","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n\n* ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-16T12:01:37.029289Z","modified":"2026-10-16T12:45:02.618264084Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:83553","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n\n* ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-16T12:05:26.574296Z","modified":"2026-10-16T12:45:03.605326512Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-103226","description":"A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\"","status":"published","published":"2026-09-30T15:22:00Z","modified":"2026-10-28T20:16:17.69604892Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T16:55:58.519486Z"},{"id":"ALSA-2026:83551","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n  * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-29T11:31:01.714265524Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:83552","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n  * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-29T11:02:25.165045435Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:83553","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)\n  * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-29T11:32:38.256873505Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1791294114","title":"ghostscript: Fix of 2 CVEs","description":"- CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter when\n  components are subsampled below 8 bits per sample\n- CVE-2026-103226: bound the control stack in the Type 1 to Type 2 font\n  conversion used by pdfwrite\n- CVE-2025-27830: count every $Blend procedure entry in the length and bound\n  the formatting of its numbers so the serialized procedure cannot overflow\n  its buffer (upstream Bug 706923 and gs_snprintf)","status":"published","published":"2026-10-06T13:42:05Z","modified":"2026-10-26T09:43:45.632876618Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791463004","title":"ghostscript: Fix of 3 CVEs","description":"- CVE-2026-39919: heap buffer overflow in the JPEG 2000 output adapter\n  with subsampled components (base/sjpx_openjpeg.c)\n- CVE-2026-103226: stack buffer overflow in the pdfwrite Type 1 to Type\n  2 font converter control stack (devices/vector/gdevpsfx.c)","status":"published","published":"2026-10-23T23:29:56Z","modified":"2026-10-26T09:43:14.575613145Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"openSUSE-SU-2026:12128-1","title":"ghostscript-10.08.0-2.1 on GA media","description":"These are all security issues fixed in the ghostscript-10.08.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-14T00:00:00Z","modified":"2026-10-15T17:23:12.976749716Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22176-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free\n  (bsc#1284397).\n- CVE-2026-103226: stack-based buffer overflow in `pdfwrite` via crafted font data (bsc#1283917).\n","status":"published","published":"2026-10-27T14:35:50Z","modified":"2026-11-01T17:23:29.417069619Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24468-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free\n  (bsc#1284397).\n- CVE-2026-103226: stack-based buffer overflow in `pdfwrite` via crafted font data (bsc#1283917).\n","status":"published","published":"2026-10-27T14:35:51Z","modified":"2026-11-04T17:23:17.641005127Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:5039-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free\n  (bsc#1284397).\n- CVE-2026-103226: stack-based buffer overflow in `pdfwrite` via crafted font data (bsc#1283917).\n","status":"published","published":"2026-11-02T16:23:54Z","modified":"2026-11-03T13:15:08.785916628Z","updated_at":"2026-11-03T13:33:04.521148Z"},{"id":"SUSE-SU-2026:5094-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- CVE-2026-101258: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free\n  (bsc#1284397).\n- CVE-2026-103226: stack-based buffer overflow in `pdfwrite` via crafted font data (bsc#1283917).\n","status":"published","published":"2026-11-04T08:16:20Z","modified":"2026-11-04T23:00:26.609709935Z","updated_at":"2026-11-04T23:09:59.08306Z"},{"id":"USN-8949-1","title":"ghostscript vulnerabilities","description":"Rick de Jager discovered that Ghostscript incorrectly handled memory\nunder certain circumstances when processing PostScript documents. If a\nuser or automated system were tricked into processing a specially crafted\ndocument, an attacker could possibly use this issue to bypass the sandbox\nand execute arbitrary code. (CVE-2026-101258)\n\nIt was discovered that Ghostscript incorrectly handled memory when\nconverting certain fonts. If a user or automated system were tricked into\nprocessing a specially crafted file, an attacker could possibly use this\nissue to cause Ghostscript to crash, or possibly execute arbitrary code.\n(CVE-2026-103226)\n\nPaulos Yibelo discovered that Ghostscript did not properly validate\ncertain operands when loading fonts. If a user or automated system were\ntricked into processing a specially crafted file, an attacker could\npossibly use this issue to bypass the sandbox and execute arbitrary code.\n(No CVE number)","status":"published","published":"2026-10-21T15:39:32Z","modified":"2026-10-22T23:27:00.207345393Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}