CVE-2026-103226
published 2026-09-30CVE-2026-103226: A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the…
PriorityP343medium6.3CVSS 3.1
AVNACLPRNUIRSUCLILAL
EPSS
0.52%
43.3th percentile
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | ghostscript | — | — |
| artifex | ghostscript | — | — |
| ubuntu | ghostscript | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_ubuntu7.8HIGH
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Ghostscript vulnerabilities
vendor_ubuntu·2026-10-21·CVSS 7.8
CVE-2026-103226 [HIGH] Ghostscript vulnerabilities
Title: Ghostscript vulnerabilities
Summary: Several security issues were fixed in Ghostscript.
Rick de Jager discovered that Ghostscript incorrectly handled memory
under certain circumstances when processing PostScript documents. If a
user or automated system were tricked into processing a specially crafted
document, an attacker could possibly use this issue to bypass the sandbox
and execute arbitrary code. (CVE-2026-101258)
It was discovered that Ghostscript incorrectly handled memory when
converting certain fonts. If a user or automated system were tricked into
processing a specially crafted file, an attacker could possibly use this
issue to cause Ghostscript to crash, or possibly execute arbitrary code.
(CVE-2026-103226)
Paulos Yibelo discovered that Ghostscript did not properly val
Red Hat
ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data
vendor_redhat·2026-09-30·CVSS 6.3
CVE-2026-103226 [MEDIUM] CWE-787 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data
ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data
A flaw was found in ghostscript. This vulnerability allows a remote attacker to trigger an application crash leading to a Denial of Service (DoS) or potentially execute arbitrary code by tricking a user or service into processing a specially crafted file. The issue stems from a stack-based buffer overflow in the pdfwrite component during Type 1 font processing.
Package: ghostscript (Red Hat Enterprise Linux 10) - Affected
Package: ghostscript (Red Hat Enterprise Linux 6) - Affected
Package: ghostscript (Red Hat Enterprise Linux 7) - Affected
Package: ghostscript (Red Hat Enterprise Linux 8) - Affected
Package: ghostscript (Red Hat Enterprise Linux 9) - Affected
VulDB
Artifex Ghostscript up to 10.07.0 Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow (Bug 709672 / EUVD-2026-89962)
vuldb·2026-10-15·CVSS 6.3
CVE-2026-103226 [MEDIUM] Artifex Ghostscript up to 10.07.0 Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow (Bug 709672 / EUVD-2026-89962)
A vulnerability marked as critical has been reported in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow.
This vulnerability is referenced as CVE-2026-103226. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
It is suggested to upgrade the affected component.
A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
GHSA
A vulnerability was identified in Artifex Ghostscript up to 10.09.0.
ghsa_unreviewed·2026-09-30
CVE-2026-103226 [LOW] CWE-119 A vulnerability was identified in Artifex Ghostscript up to 10.09.0.
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data [fedora-all]
bugzilla·2026-10-01·CVSS 6.3
CVE-2026-103226 [MEDIUM] CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data [fedora-all]
CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differen
Bugzilla
CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data
bugzilla·2026-09-30·CVSS 6.3
CVE-2026-103226 [MEDIUM] CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data
CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
https://artifex.com/https://bugs.ghostscript.com/attachment.cgi?id=28495https://bugs.ghostscript.com/show_bug.cgi?id=709672https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3https://ghostscript.com/releases/gsdnld.htmlhttps://vuldb.com/cve/CVE-2026-103226https://vuldb.com/submit/955016https://vuldb.com/vuln/411906https://vuldb.com/vuln/411906/cti
2026-09-30
Published