p PatchFirst

CVE-2026-103226

CVE-2026-103226 · Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • ghostscript

    Versions
    • 10.07: Affected
    • 10.08.0: Not affected

    Update to 10.08.0

  • ghostscript Debian:12

    Versions
    • 10.0.0~dfsg-11
    • 10.0.0~dfsg-11+deb12u1
    • 10.0.0~dfsg-11+deb12u2
    • 10.0.0~dfsg-11+deb12u3
    • 10.0.0~dfsg-11+deb12u4
    • 10.0.0~dfsg-11+deb12u5
    • 10.0.0~dfsg-11+deb12u6
    • 10.0.0~dfsg-11+deb12u7
    • 10.0.0~dfsg-11+deb12u8
    • 10.01.2~dfsg-1
    • 10.02.0~dfsg-1
    • 10.02.0~dfsg-2
    • 10.02.1~dfsg-1
    • 10.02.1~dfsg-2
    • 10.02.1~dfsg-3
    • 10.03.0~dfsg-1
    • 10.03.1~dfsg-1
    • 10.03.1~dfsg-2
    • 10.03.1~dfsg~git20240518-1
    • 10.04.0~dfsg-1
    • 10.04.0~dfsg-2
    • 10.05.0~dfsg-1
    • 10.05.1~dfsg-1
    • 10.05.1~dfsg-2
    • 10.05.1~dfsg-3
    • 10.06.0~dfsg-1
    • 10.06.0~dfsg-2
    • 10.06.0~dfsg-3
    • 10.07.0~dfsg-1
    • 10.07.0~dfsg-2
    • 10.07.1~dfsg-1
    • 10.08.0~dfsg-1
    • 10.08.0~dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ghostscript Debian:13

    Versions
    • 10.05.1~dfsg-1
    • 10.05.1~dfsg-1+deb13u1
    • 10.05.1~dfsg-1+deb13u2
    Affected ranges
    • ECOSYSTEM: < 10.05.1~dfsg-1+deb13u3

    Update to 10.05.1~dfsg-1+deb13u3

  • ghostscript Debian:14

    Versions
    • 10.05.1~dfsg-1
    • 10.05.1~dfsg-2
    • 10.05.1~dfsg-3
    • 10.06.0~dfsg-1
    • 10.06.0~dfsg-2
    • 10.06.0~dfsg-3
    • 10.07.0~dfsg-1
    • 10.07.0~dfsg-2
    • 10.07.1~dfsg-1
    Affected ranges
    • ECOSYSTEM: < 10.08.0~dfsg-1

    Update to 10.08.0~dfsg-1

  • ghostscript Ubuntu:Pro:16.04:LTS

    Versions
    • 9.16~dfsg~0-0ubuntu3
    • 9.16~dfsg~0-0ubuntu4
    • 9.18~dfsg~0-0ubuntu1
    • 9.18~dfsg~0-0ubuntu2
    • 9.18~dfsg~0-0ubuntu2.2
    • 9.18~dfsg~0-0ubuntu2.3
    • 9.18~dfsg~0-0ubuntu2.4
    • 9.18~dfsg~0-0ubuntu2.6
    • 9.18~dfsg~0-0ubuntu2.7
    • 9.18~dfsg~0-0ubuntu2.8
    • 9.18~dfsg~0-0ubuntu2.9
    • 9.25~dfsg+1-0ubuntu0.16.04.1
    • 9.25~dfsg+1-0ubuntu0.16.04.2
    • 9.25~dfsg+1-0ubuntu0.16.04.3
    • 9.26~dfsg+0-0ubuntu0.16.04.1
    • 9.26~dfsg+0-0ubuntu0.16.04.3
    • 9.26~dfsg+0-0ubuntu0.16.04.4
    • 9.26~dfsg+0-0ubuntu0.16.04.5
    • 9.26~dfsg+0-0ubuntu0.16.04.6
    • 9.26~dfsg+0-0ubuntu0.16.04.7
    • 9.26~dfsg+0-0ubuntu0.16.04.8
    • 9.26~dfsg+0-0ubuntu0.16.04.9
    • 9.26~dfsg+0-0ubuntu0.16.04.10
    • 9.26~dfsg+0-0ubuntu0.16.04.11
    • 9.26~dfsg+0-0ubuntu0.16.04.12
    • 9.26~dfsg+0-0ubuntu0.16.04.13
    • 9.26~dfsg+0-0ubuntu0.16.04.14
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm1
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm2
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm3
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm4
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm5
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm6
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm7
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm8
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm9
    • 9.26~dfsg+0-0ubuntu0.16.04.14+esm10
    Affected ranges
    • ECOSYSTEM: < 9.26~dfsg+0-0ubuntu0.16.04.14+esm11

    Update to 9.26~dfsg+0-0ubuntu0.16.04.14+esm11

  • ghostscript Ubuntu:Pro:18.04:LTS

    Versions
    • 9.21~dfsg+1-0ubuntu3
    • 9.22~dfsg+1-0ubuntu1
    • 9.22~dfsg+1-0ubuntu1.1
    • 9.22~dfsg+1-0ubuntu1.2
    • 9.25~dfsg+1-0ubuntu0.18.04.1
    • 9.25~dfsg+1-0ubuntu0.18.04.2
    • 9.26~dfsg+0-0ubuntu0.18.04.1
    • 9.26~dfsg+0-0ubuntu0.18.04.3
    • 9.26~dfsg+0-0ubuntu0.18.04.4
    • 9.26~dfsg+0-0ubuntu0.18.04.5
    • 9.26~dfsg+0-0ubuntu0.18.04.6
    • 9.26~dfsg+0-0ubuntu0.18.04.7
    • 9.26~dfsg+0-0ubuntu0.18.04.8
    • 9.26~dfsg+0-0ubuntu0.18.04.9
    • 9.26~dfsg+0-0ubuntu0.18.04.10
    • 9.26~dfsg+0-0ubuntu0.18.04.11
    • 9.26~dfsg+0-0ubuntu0.18.04.12
    • 9.26~dfsg+0-0ubuntu0.18.04.13
    • 9.26~dfsg+0-0ubuntu0.18.04.14
    • 9.26~dfsg+0-0ubuntu0.18.04.15
    • 9.26~dfsg+0-0ubuntu0.18.04.16
    • 9.26~dfsg+0-0ubuntu0.18.04.17
    • 9.26~dfsg+0-0ubuntu0.18.04.18
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm1
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm2
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm3
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm4
    • 9.26~dfsg+0-0ubuntu0.18.04.18+esm5
    Affected ranges
    • ECOSYSTEM: < 9.26~dfsg+0-0ubuntu0.18.04.18+esm6

    Update to 9.26~dfsg+0-0ubuntu0.18.04.18+esm6

  • ghostscript Ubuntu:Pro:20.04:LTS

    Versions
    • 9.27~dfsg+0-0ubuntu3
    • 9.27~dfsg+0-0ubuntu4
    • 9.50~dfsg-5ubuntu1
    • 9.50~dfsg-5ubuntu2
    • 9.50~dfsg-5ubuntu3
    • 9.50~dfsg-5ubuntu4
    • 9.50~dfsg-5ubuntu4.1
    • 9.50~dfsg-5ubuntu4.2
    • 9.50~dfsg-5ubuntu4.3
    • 9.50~dfsg-5ubuntu4.4
    • 9.50~dfsg-5ubuntu4.5
    • 9.50~dfsg-5ubuntu4.6
    • 9.50~dfsg-5ubuntu4.7
    • 9.50~dfsg-5ubuntu4.8
    • 9.50~dfsg-5ubuntu4.9
    • 9.50~dfsg-5ubuntu4.10
    • 9.50~dfsg-5ubuntu4.11
    • 9.50~dfsg-5ubuntu4.12
    • 9.50~dfsg-5ubuntu4.13
    • 9.50~dfsg-5ubuntu4.14
    • 9.50~dfsg-5ubuntu4.15
    • 9.50~dfsg-5ubuntu4.15+esm1
    • 9.50~dfsg-5ubuntu4.15+esm2
    Affected ranges
    • ECOSYSTEM: < 9.50~dfsg-5ubuntu4.15+esm3

    Update to 9.50~dfsg-5ubuntu4.15+esm3

  • ghostscript Ubuntu:22.04:LTS

    Versions
    • 9.54.0~dfsg1-0ubuntu2
    • 9.55.0~dfsg1-0ubuntu4
    • 9.55.0~dfsg1-0ubuntu5
    • 9.55.0~dfsg1-0ubuntu5.1
    • 9.55.0~dfsg1-0ubuntu5.2
    • 9.55.0~dfsg1-0ubuntu5.3
    • 9.55.0~dfsg1-0ubuntu5.4
    • 9.55.0~dfsg1-0ubuntu5.5
    • 9.55.0~dfsg1-0ubuntu5.6
    • 9.55.0~dfsg1-0ubuntu5.7
    • 9.55.0~dfsg1-0ubuntu5.9
    • 9.55.0~dfsg1-0ubuntu5.10
    • 9.55.0~dfsg1-0ubuntu5.11
    • 9.55.0~dfsg1-0ubuntu5.12
    • 9.55.0~dfsg1-0ubuntu5.13
    • 9.55.0~dfsg1-0ubuntu5.14
    Affected ranges
    • ECOSYSTEM: < 9.55.0~dfsg1-0ubuntu5.15

    Update to 9.55.0~dfsg1-0ubuntu5.15

  • ghostscript Ubuntu:24.04:LTS

    Versions
    • 10.01.2~dfsg1-0ubuntu2
    • 10.01.2~dfsg1-0ubuntu2.1
    • 10.02.1~dfsg1-0ubuntu1
    • 10.02.1~dfsg1-0ubuntu2
    • 10.02.1~dfsg1-0ubuntu5
    • 10.02.1~dfsg1-0ubuntu6
    • 10.02.1~dfsg1-0ubuntu7
    • 10.02.1~dfsg1-0ubuntu7.1
    • 10.02.1~dfsg1-0ubuntu7.3
    • 10.02.1~dfsg1-0ubuntu7.4
    • 10.02.1~dfsg1-0ubuntu7.5
    • 10.02.1~dfsg1-0ubuntu7.6
    • 10.02.1~dfsg1-0ubuntu7.7
    • 10.02.1~dfsg1-0ubuntu7.8
    • 10.02.1~dfsg1-0ubuntu7.9
    Affected ranges
    • ECOSYSTEM: < 10.02.1~dfsg1-0ubuntu7.10

    Update to 10.02.1~dfsg1-0ubuntu7.10

  • ghostscript Ubuntu:26.10

    Versions
    • 10.06.0~dfsg-3ubuntu1
    • 10.07.1~dfsg-1ubuntu1
    • 10.07.1~dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 10.07.1~dfsg-1ubuntu2.1

    Update to 10.07.1~dfsg-1ubuntu2.1

  • ghostscript Ubuntu:26.04:LTS

    Versions
    • 10.05.0dfsg1-0ubuntu4
    • 10.05.0dfsg1-0ubuntu5
    • 10.06.0~dfsg-3ubuntu1
    • 10.06.0~dfsg-3ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 10.06.0~dfsg-3ubuntu1.2

    Update to 10.06.0~dfsg-3ubuntu1.2

Original sources

Check your server →