{"id":"CVE-2026-112177","aliases":["ALSA-2026:93978","EUVD-2026-104827","GHSA-4hx3-pq6p-jhg6","RLSA-2026:93978"],"status":"published","title":"Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8","description":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0036,"percentile":0.30167,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-648"],"published":"2026-10-20T07:25:16Z","modified":"2026-11-04T02:30:24Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"ghostscript","fixed_in":["9.27-20.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-doc","fixed_in":["9.27-20.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-tools-dvipdf","fixed_in":["9.27-20.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-tools-fonts","fixed_in":["9.27-20.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-tools-printing","fixed_in":["9.27-20.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-x11","fixed_in":["9.27-20.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libgs","fixed_in":["9.27-20.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libgs-devel","fixed_in":["9.27-20.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"ghostscript","fixed_in":["0:9.27-20.el8_10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-20.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-20.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-20.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-20.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-20.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-20.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-20.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-20.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-20.el8_10"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:93978","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112177","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555564","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/ArtifexSoftware/ghostpdl/commit/485904772c5f0aa1140032746e5a0abfc40f4cef","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112177","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4hx3-pq6p-jhg6"},{"url":"https://bugzilla.redhat.com/2555564","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-93978.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112177.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:93978","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-112177","title":"Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8","description":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.","status":"published","published":"2026-10-20T07:25:16.741Z","modified":"2026-11-04T21:54:47.818Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-648"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2026-104827","description":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.","status":"published","published":"2026-10-20T07:25:16Z","modified":"2026-11-04T21:54:47Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-04T23:47:18.620008Z"}],"ghsa":[{"id":"GHSA-4hx3-pq6p-jhg6","title":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for...","description":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.","status":"published","published":"2026-10-20T09:31:04Z","modified":"2026-11-02T21:32:36Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-648"],"updated_at":"2026-11-03T00:02:49.048371Z"}],"nvd":[{"id":"CVE-2026-112177","description":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.","status":"published","published":"2026-10-20T08:16:42.507Z","modified":"2026-11-04T22:17:48.17Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-648"],"updated_at":"2026-11-04T23:43:41.118283Z"}],"osv":[{"id":"CVE-2026-112177","title":"Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8","description":"A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.","status":"published","published":"2026-10-20T07:25:16.741Z","modified":"2026-11-05T21:16:11.102021502Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-648"],"updated_at":"2026-11-05T22:00:58.054534Z"},{"id":"RLSA-2026:93978","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: Reintroduction of .charkeys -dSAFER bypass in Rocky Linux 8 (CVE-2026-112177)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T12:01:33.643841Z","modified":"2026-11-03T12:30:03.479505029Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T13:02:16.068655Z"},{"id":"ALSA-2026:93978","title":"Important: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: Reintroduction of .charkeys -dSAFER bypass in AlmaLinux 8 (CVE-2026-112177)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-02T00:00:00Z","modified":"2026-11-02T23:00:02.517568232Z","updated_at":"2026-11-03T00:03:07.015763Z"}]}}