Critical Ghostscript Vulnerability: Important Security Update Required
Summary
RLSA-2026:83552: Important: ghostscript security update. Affects ghostscript versions < 0:9.27-19.el8_10. Fixed in 0:9.27-19.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It is widely used for converting PostScript code into various bitmap formats for display and printing. The package is essential for applications that require document processing and rendering capabilities. However, recent vulnerabilities have been identified that could compromise the security of systems using Ghostscript.
Vulnerability Detail
The vulnerability arises from a sandbox bypass in Ghostscript, specifically a Type 5 shading out-of-bounds write and a procedure-stream use-after-free issue (CVE-2026-101258). Additionally, there is a stack-based buffer overflow in the pdfwrite component due to crafted font data (CVE-2026-103226). These vulnerabilities could allow an attacker to execute arbitrary code, leading to potential data breaches or system compromises.
How To Fix
Minimum fixed version
0:9.27-19.el8_10
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the security update as soon as it is available.
Conclusion
The identified vulnerabilities in Ghostscript pose significant security risks that could lead to unauthorized access and system compromise. It is crucial to update to the latest patched version to safeguard your systems. Regular monitoring for vulnerabilities using tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of software that interprets PostScript and PDF files, allowing for their rendering and conversion into various formats.
The vulnerabilities could allow attackers to execute arbitrary code, leading to unauthorized access, data breaches, or system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Currently, there are no effective workarounds. It is highly recommended to update to the patched version as soon as possible.
The CVSS score for this vulnerability is 7.8, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
