Critical Security Update for Ghostscript: Addressing Sandbox Bypass and Buffer Overflow Vulnerabilities
Summary
ALSA-2026:83551: Important: ghostscript security update. Affects ghostscript versions < 10.02.1-16.el10_2.3. Fixed in 10.02.1-16.el10_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It is widely used for converting PostScript code into bitmap formats for display and printing. The package is essential for applications that require document rendering capabilities. However, recent vulnerabilities have been identified that could compromise the security of systems using Ghostscript.
Vulnerability Detail
The vulnerabilities in Ghostscript include a sandbox bypass via Type 5 shading out-of-bounds write and a stack-based buffer overflow in pdfwrite due to crafted font data. These vulnerabilities can allow an attacker to execute arbitrary code, potentially leading to unauthorized access or system compromise. The issues stem from improper handling of specific data types and memory management flaws within the Ghostscript codebase.
How To Fix
Minimum fixed version
10.02.1-16.el10_2.3
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of Ghostscript in environments where untrusted documents are processed. Additionally, implementing strict access controls and monitoring can help mitigate the risk until the update is applied.
Conclusion
The vulnerabilities identified in Ghostscript pose significant security risks that can lead to unauthorized access and system compromise. It is crucial for users to update to the latest patched version to protect their systems. Implementing workarounds and monitoring can help mitigate risks until updates are applied.
See every vulnerability recorded for ghostscript →
FAQ
The main vulnerabilities include a sandbox bypass that allows out-of-bounds writes and a stack-based buffer overflow caused by crafted font data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing strict access controls and monitoring to reduce the risk of exploitation.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be leveraged for arbitrary code execution.
More information can be found on the CVE pages for CVE-2026-101258 and CVE-2026-103226, which detail the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
