Ubuntu fixes Ghostscript code-execution flaws
Crafted PostScript or font files could bypass the sandbox or crash Ghostscript.
58
CVE-2026-101258
Ghostscript -dSAFER bypass to arbitrary shell commands
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A flaw in Ghostscript allows a crafted PostScript or EPS document to bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption (an out-of-bounds write, CWE-787) during document parsing with runtime disabling of internal path access controls. An attacker can supply the file directly or through workflows that hand rendering to Ghostscript, such as EPS import or print conversion; the CVSS 3.1 score is 7.8 (local, low complexity, no privileges, user interaction required) with high impact to confidentiality, integrity, and availability of data the process can access. Any system or service that processes untrusted PostScript, EPS, or related documents with Ghostscript is affected; the advisory does not state version ranges. No public proof of concept is known and the CVE is not in CISA KEV, so exploitation is not known to be in the wild.
What to do: Install the Ghostscript update from your operating-system or vendor package as soon as a fix is published; the advisory data does not name a fixed version. Until then, do not render untrusted PostScript, EPS, or print/conversion jobs with Ghostscript, and isolate services that accept those formats. Check whether CUPS, ImageMagick, office suites, or similar tools on your systems delegate rendering to Ghostscript and limit those paths to trusted input.
| Product | Affected |
|---|---|
| Artifex Software Ghostscript | — |
Estimated exposure
massHundreds of millions of installations (order of magnitude) across Linux systems and document/print pipelines — Ghostscript is a default or common package on major Linux distributions and a dependency of widely deployed document and print tools such as CUPS and ImageMagick; no install count is given in the advisory, so this is an order-of-magnitude…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.
- Weakness
- CWE-787
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H