Critical Security Update for Ghostscript and libgs: CVE-2026-101258 and CVE-2026-103226
Summary
RHSA-2026:83551: Red Hat Security Advisory: ghostscript security update. Affects ghostscript versions < 0:10.02.1-16.el10_2.3. Fixed in 0:10.02.1-16.el10_2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The libgs library is a core component of Ghostscript, providing essential functionalities for graphics and document processing. This vulnerability affects versions prior to 0:10.02.1-16.el10_2.3, potentially exposing systems to security risks.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-101258 and CVE-2026-103226 in Ghostscript and libgs allow for potential remote code execution and denial of service. These vulnerabilities arise from improper handling of certain inputs, which can be exploited by attackers to execute arbitrary code or crash the application. The CVSS score of 7.8 indicates a high severity level, emphasizing the need for immediate attention and remediation.
How To Fix
Minimum fixed version
0:10.02.1-16.el10_2.3
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the Ghostscript and libgs services or limit the input sources to trusted entities until the update is applied. Additionally, consider disabling any unnecessary features that may expose the system to risk.
Conclusion
The vulnerabilities in Ghostscript and libgs pose significant security risks that require immediate attention. Updating to the latest patched version is crucial to safeguard your systems. Utilize tools like Vulert for ongoing monitoring and vulnerability management.
See every vulnerability recorded for ghostscript →
FAQ
The main risks include potential remote code execution and denial of service, which could compromise system integrity and availability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, implement workarounds such as restricting access to the affected services and limiting input sources.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
