Ubuntu fixes Ghostscript code-execution flaws
Original title: USN-8949-1: Ghostscript vulnerabilities
Crafted PostScript or font files could bypass the sandbox or crash Ghostscript.
Ubuntu security notice USN-8949-1 covers Ghostscript memory-handling flaws. Rick de Jager found that crafted PostScript could bypass the sandbox and execute arbitrary code, tracked as CVE-2026-101258. A separate font-conversion flaw, CVE-2026-103226, could crash Ghostscript or possibly execute code. The notice text is cut off after another discovery by Paulos Yibelo.
Unconfirmed: The notice is truncated, so additional Ghostscript issues and fixed versions are not shown.
- CVE-2026-101258 can bypass the Ghostscript sandbox for code execution.
- CVE-2026-103226 involves memory handling while converting certain fonts.
- A user or automated system must process a crafted file.
Impact: sandbox bypass and possible arbitrary code execution
| Product | Affected |
|---|---|
| Ghostscript | — |
- 1.Install the Ghostscript updates published in USN-8949-1.
- ATT&CK
- T1204.002 Malicious File
- Products
- Ghostscript
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101258 | Ghostscript -dSAFER bypass to arbitrary shell commands | 7.8 | — | ||
| CVE-2026-103226 | A vulnerability was identified in Artifex Ghostscript up to 10.07.0 | 2.1 | — |
From the original article
Rick de Jager discovered that Ghostscript incorrectly handled memory under certain circumstances when processing PostScript documents. If a user or automated system were tricked into processing a specially crafted document, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.