Critical Ghostscript Vulnerability: Important Security Update Required
Summary
RLSA-2026:83551: Important: ghostscript security update. Affects ghostscript versions < 0:10.02.1-16.el10_2.3. Fixed in 0:10.02.1-16.el10_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats, enabling users to display or print the code effectively. However, recent vulnerabilities have been identified that could potentially compromise the security of systems utilizing Ghostscript, making it essential for users to stay updated with the latest patches.
Vulnerability Detail
The Ghostscript suite has been found to contain significant vulnerabilities. One vulnerability allows a sandbox bypass via Type 5 shading, leading to an out-of-bounds write and a use-after-free condition (CVE-2026-101258). Another vulnerability involves a stack-based buffer overflow in the pdfwrite utility when processing crafted font data (CVE-2026-103226). These vulnerabilities can lead to unauthorized access, data corruption, or system crashes, posing a serious risk to users.
How To Fix
Minimum fixed version
0:10.02.1-16.el10_2.3
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict the use of Ghostscript in environments where security is a concern until the package is updated. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The identified vulnerabilities in Ghostscript pose significant risks to users, making it crucial to apply the necessary updates to safeguard systems. By following the outlined steps to update the package, users can mitigate potential threats effectively.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of software that interprets PostScript and PDF files, allowing them to be rendered and printed.
The vulnerabilities include a sandbox bypass that leads to out-of-bounds writes and a stack-based buffer overflow when processing crafted font data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.8, indicating a high level of severity.
It is recommended to regularly check for updates and apply them promptly to ensure the security of your system.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
