p PatchFirst

CVE-2026-101258

CVE-2026-101258 · Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.

CVSS 7.8 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    Versions
    • ≥ 0:10.02.1-16.el10_2.3: Not affected (rpm)

    No fix published

  • red hat enterprise linux 8

    Versions
    • ≥ 0:9.27-19.el8_10: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9

    Versions
    • ≥ 0:9.54.0-19.el9_8.3: Not affected (rpm)

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • red hat enterprise linux 7

    No fix published

  • ghostscript Debian:12

    Versions
    • 10.0.0~dfsg-11
    • 10.0.0~dfsg-11+deb12u1
    • 10.0.0~dfsg-11+deb12u2
    • 10.0.0~dfsg-11+deb12u3
    • 10.0.0~dfsg-11+deb12u4
    • 10.0.0~dfsg-11+deb12u5
    • 10.0.0~dfsg-11+deb12u6
    • 10.0.0~dfsg-11+deb12u7
    • 10.0.0~dfsg-11+deb12u8
    • 10.01.2~dfsg-1
    • 10.02.0~dfsg-1
    • 10.02.0~dfsg-2
    • 10.02.1~dfsg-1
    • 10.02.1~dfsg-2
    • 10.02.1~dfsg-3
    • 10.03.0~dfsg-1
    • 10.03.1~dfsg-1
    • 10.03.1~dfsg-2
    • 10.03.1~dfsg~git20240518-1
    • 10.04.0~dfsg-1
    • 10.04.0~dfsg-2
    • 10.05.0~dfsg-1
    • 10.05.1~dfsg-1
    • 10.05.1~dfsg-2
    • 10.05.1~dfsg-3
    • 10.06.0~dfsg-1
    • 10.06.0~dfsg-2
    • 10.06.0~dfsg-3
    • 10.07.0~dfsg-1
    • 10.07.0~dfsg-2
    • 10.07.1~dfsg-1
    • 10.08.0~dfsg-1
    • 10.08.0~dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ghostscript Debian:13

    Versions
    • 10.05.1~dfsg-1
    • 10.05.1~dfsg-1+deb13u1
    • 10.05.1~dfsg-1+deb13u2
    Affected ranges
    • ECOSYSTEM: < 10.05.1~dfsg-1+deb13u3

    Update to 10.05.1~dfsg-1+deb13u3

  • ghostscript Debian:14

    Versions
    • 10.05.1~dfsg-1
    • 10.05.1~dfsg-2
    • 10.05.1~dfsg-3
    • 10.06.0~dfsg-1
    • 10.06.0~dfsg-2
    • 10.06.0~dfsg-3
    • 10.07.0~dfsg-1
    • 10.07.0~dfsg-2
    • 10.07.1~dfsg-1
    Affected ranges
    • ECOSYSTEM: < 10.08.0~dfsg-1

    Update to 10.08.0~dfsg-1

  • ghostscript Ubuntu:Pro:16.04:LTS

    Versions
    • 9.16~dfsg~0-0ubuntu3
    • 9.16~dfsg~0-0ubuntu4
    • 9.18~dfsg~0-0ubuntu1
    • 9.18~dfsg~0-0ubuntu2
    • 9.18~dfsg~0-0ubuntu2.2
    • 9.18~dfsg~0-0ubuntu2.3
    • 9.18~dfsg~0-0ubuntu2.4
    • 9.18~dfsg~0-0ubuntu2.6
    • 9.18~dfsg~0-0ubuntu2.7
    • 9.18~dfsg~0-0ubuntu2.8
    • 9.18~dfsg~0-0ubuntu2.9
    • 9.25~dfsg+1-0ubuntu0.16.04.1
    • 9.25~dfsg+1-0ubuntu0.16.04.2
    • 9.25~dfsg+1-0ubuntu0.16.04.3
    • 9.26~dfsg+0-0ubuntu0.16.04.1
    • 9.26~dfsg+0-0ubuntu0.16.04.3
    • 9.26~dfsg+0-0ubuntu0.16.04.4
    • 9.26~dfsg+0-0ubuntu0.16.04.5
    • 9.26~dfsg+0-0ubuntu0.16.04.6
    • 9.26~dfsg+0-0ubuntu0.16.04.7
    • 9.26~dfsg+0-0ubuntu0.16.04.8
    • 9.26~dfsg+0-0ubuntu0.16.04.9
    • 9.26~dfsg+0-0ubuntu0.16.04.10
    • 9.26~dfsg+0-0ubuntu0.16.04.11
    • 9.26~dfsg+0-0ubuntu0.16.04.12
    • 9.26~dfsg+0-0ubuntu0.16.04.13
    • 9.26~dfsg+0-0ubuntu0.16.04.14
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm1
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm2
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm3
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm4
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm5
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm6
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm7
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm8
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm9
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm10
    Affected ranges
    • ECOSYSTEM: < 9.26~dfsg+0-0ubuntu0.16.04.14+esm11

    Update to 9.26~dfsg+0-0ubuntu0.16.04.14+esm11

  • ghostscript Ubuntu:Pro:18.04:LTS

    Versions
    • 9.21~dfsg+1-0ubuntu3
    • 9.22~dfsg+1-0ubuntu1
    • 9.22~dfsg+1-0ubuntu1.1
    • 9.22~dfsg+1-0ubuntu1.2
    • 9.25~dfsg+1-0ubuntu0.18.04.1
    • 9.25~dfsg+1-0ubuntu0.18.04.2
    • 9.26~dfsg+0-0ubuntu0.18.04.1
    • 9.26~dfsg+0-0ubuntu0.18.04.3
    • 9.26~dfsg+0-0ubuntu0.18.04.4
    • 9.26~dfsg+0-0ubuntu0.18.04.5
    • 9.26~dfsg+0-0ubuntu0.18.04.6
    • 9.26~dfsg+0-0ubuntu0.18.04.7
    • 9.26~dfsg+0-0ubuntu0.18.04.8
    • 9.26~dfsg+0-0ubuntu0.18.04.9
    • 9.26~dfsg+0-0ubuntu0.18.04.10
    • 9.26~dfsg+0-0ubuntu0.18.04.11
    • 9.26~dfsg+0-0ubuntu0.18.04.12
    • 9.26~dfsg+0-0ubuntu0.18.04.13
    • 9.26~dfsg+0-0ubuntu0.18.04.14
    • 9.26~dfsg+0-0ubuntu0.18.04.15
    • 9.26~dfsg+0-0ubuntu0.18.04.16
    • 9.26~dfsg+0-0ubuntu0.18.04.17
    • 9.26~dfsg+0-0ubuntu0.18.04.18
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm1
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm2
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm3
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm4
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm5
    Affected ranges
    • ECOSYSTEM: < 9.26~dfsg+0-0ubuntu0.18.04.18+esm6

    Update to 9.26~dfsg+0-0ubuntu0.18.04.18+esm6

  • ghostscript Ubuntu:Pro:20.04:LTS

    Versions
    • 9.27~dfsg+0-0ubuntu3
    • 9.27~dfsg+0-0ubuntu4
    • 9.50~dfsg-5ubuntu1
    • 9.50~dfsg-5ubuntu2
    • 9.50~dfsg-5ubuntu3
    • 9.50~dfsg-5ubuntu4
    • 9.50~dfsg-5ubuntu4.1
    • 9.50~dfsg-5ubuntu4.2
    • 9.50~dfsg-5ubuntu4.3
    • 9.50~dfsg-5ubuntu4.4
    • 9.50~dfsg-5ubuntu4.5
    • 9.50~dfsg-5ubuntu4.6
    • 9.50~dfsg-5ubuntu4.7
    • 9.50~dfsg-5ubuntu4.8
    • 9.50~dfsg-5ubuntu4.9
    • 9.50~dfsg-5ubuntu4.10
    • 9.50~dfsg-5ubuntu4.11
    • 9.50~dfsg-5ubuntu4.12
    • 9.50~dfsg-5ubuntu4.13
    • 9.50~dfsg-5ubuntu4.14
    • 9.50~dfsg-5ubuntu4.15
    • 9.50~dfsg-5ubuntu4.15+esm1
    • 9.50~dfsg-5ubuntu4.15+esm2
    Affected ranges
    • ECOSYSTEM: < 9.50~dfsg-5ubuntu4.15+esm3

    Update to 9.50~dfsg-5ubuntu4.15+esm3

  • ghostscript Ubuntu:22.04:LTS

    Versions
    • 9.54.0~dfsg1-0ubuntu2
    • 9.55.0~dfsg1-0ubuntu4
    • 9.55.0~dfsg1-0ubuntu5
    • 9.55.0~dfsg1-0ubuntu5.1
    • 9.55.0~dfsg1-0ubuntu5.2
    • 9.55.0~dfsg1-0ubuntu5.3
    • 9.55.0~dfsg1-0ubuntu5.4
    • 9.55.0~dfsg1-0ubuntu5.5
    • 9.55.0~dfsg1-0ubuntu5.6
    • 9.55.0~dfsg1-0ubuntu5.7
    • 9.55.0~dfsg1-0ubuntu5.9
    • 9.55.0~dfsg1-0ubuntu5.10
    • 9.55.0~dfsg1-0ubuntu5.11
    • 9.55.0~dfsg1-0ubuntu5.12
    • 9.55.0~dfsg1-0ubuntu5.13
    • 9.55.0~dfsg1-0ubuntu5.14
    Affected ranges
    • ECOSYSTEM: < 9.55.0~dfsg1-0ubuntu5.15

    Update to 9.55.0~dfsg1-0ubuntu5.15

  • ghostscript Ubuntu:24.04:LTS

    Versions
    • 10.01.2~dfsg1-0ubuntu2
    • 10.01.2~dfsg1-0ubuntu2.1
    • 10.02.1~dfsg1-0ubuntu1
    • 10.02.1~dfsg1-0ubuntu2
    • 10.02.1~dfsg1-0ubuntu5
    • 10.02.1~dfsg1-0ubuntu6
    • 10.02.1~dfsg1-0ubuntu7
    • 10.02.1~dfsg1-0ubuntu7.1
    • 10.02.1~dfsg1-0ubuntu7.3
    • 10.02.1~dfsg1-0ubuntu7.4
    • 10.02.1~dfsg1-0ubuntu7.5
    • 10.02.1~dfsg1-0ubuntu7.6
    • 10.02.1~dfsg1-0ubuntu7.7
    • 10.02.1~dfsg1-0ubuntu7.8
    • 10.02.1~dfsg1-0ubuntu7.9
    Affected ranges
    • ECOSYSTEM: < 10.02.1~dfsg1-0ubuntu7.10

    Update to 10.02.1~dfsg1-0ubuntu7.10

  • ghostscript Ubuntu:26.10

    Versions
    • 10.06.0~dfsg-3ubuntu1
    • 10.07.1~dfsg-1ubuntu1
    • 10.07.1~dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 10.07.1~dfsg-1ubuntu2.1

    Update to 10.07.1~dfsg-1ubuntu2.1

  • ghostscript Ubuntu:26.04:LTS

    Versions
    • 10.05.0dfsg1-0ubuntu4
    • 10.05.0dfsg1-0ubuntu5
    • 10.06.0~dfsg-3ubuntu1
    • 10.06.0~dfsg-3ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 10.06.0~dfsg-3ubuntu1.2

    Update to 10.06.0~dfsg-3ubuntu1.2

Original sources

Check your server →