Critical Security Update for Ghostscript and libgs: CVE-2026-101258 and CVE-2026-103226
Summary
RHSA-2026:83552: Red Hat Security Advisory: ghostscript security update. Affects ghostscript versions < 0:9.27-19.el8_10. Fixed in 0:9.27-19.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents. The libgs library is a core component of Ghostscript, providing essential functionalities for document manipulation. This vulnerability affects versions prior to 0:9.27-19.el8_10, making systems running outdated versions susceptible to security risks.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-101258 and CVE-2026-103226 expose Ghostscript and libgs to potential attacks that could lead to unauthorized access, data leakage, or system compromise. These vulnerabilities arise from improper handling of certain input files, which can be exploited by attackers to execute arbitrary code or cause denial of service. The CVSS score of this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
0:9.27-19.el8_10
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the Ghostscript and libgs functionalities or disabling any services that rely on these packages until the update can be applied.
Conclusion
In summary, the vulnerabilities in Ghostscript and libgs pose significant security risks that can be mitigated by updating to the latest patched versions. Users are encouraged to take immediate action to secure their systems and utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for ghostscript →
FAQ
The main risks include unauthorized access to sensitive data, potential system compromise, and denial of service attacks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Yes, Vulert provides a solution that uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
If you cannot update immediately, consider implementing workarounds such as restricting access to the affected functionalities or disabling related services.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
