Read the docs
TI-2026-65606 Aliases CVE-2026-103226GHSA-f9vm-qh24-w7rf

Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow

Priority LOW 24CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00319 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial Ghostscript (Artifex): 10.08.0Red Hat: 3 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ArtifexGhostscript10.0710.08.0Patch availableCNA
  • Ghostscript VendorArtifex Affected 10.07 Fixed in 10.08.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*——Artifex
  • cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:* Versions — — ·Artifex

Remediation

  • Fix · CNA Ghostscript (Artifex) Fixed in 10.08.0

Red Hat 3 advisories

  • RHSA-2026:83553 Released 2026-10-15 · Red Hat rating Important
    ghostscript security update
    • Red Hat Enterprise Linux AppStream (v. 9) ghostscript-9.54.0-19.el9_8.3, libgs-9.54.0-19.el9_8.3
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) ghostscript-9.54.0-19.el9_8.3
  • RHSA-2026:83551 Released 2026-10-15 · Red Hat rating Important
    ghostscript security update
    • Red Hat Enterprise Linux AppStream (v. 10) ghostscript-10.02.1-16.el10_2.3, libgs-10.02.1-16.el10_2.3
  • RHSA-2026:83552 Released 2026-10-15 · Red Hat rating Important
    ghostscript security update
    • Red Hat Enterprise Linux AppStream (v. 8) ghostscript-9.27-19.el8_10, libgs-9.27-19.el8_10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:83551
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:83552
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:83553
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:83553
Not affected: 6 products
  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux CRB (v. 8)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-103226
  2. 2026-10-03 Alias added: GHSA-f9vm-qh24-w7rf
  3. 2026-10-16 Fix available: Artifex/[email protected] · CNA
  4. 2026-10-16 1 new reference · CNA
  5. 2026-10-16 Fix available: RHSA-2026:83551 · Red Hat
  6. 2026-10-16 Fix available: RHSA-2026:83552 · Red Hat
  7. 2026-10-16 Fix available: RHSA-2026:83553 · Red Hat
  8. 2026-10-16 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +1 · Red Hat

References

Exploit 1

Patch 1

Other 3

  • TI-2017-05861 Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution… KEVCVSS 3.1HIGH 7.8
  • TI-2021-02712 Improper input validation in ghostscript CVSS 3.1CRITICAL 9.9
  • TI-2023-13382 In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential… CVSS 3.1CRITICAL 9.8
  • TI-2021-13164 Memory corruption in mujs CVSS 3.1CRITICAL 9.8
  • TI-2018-11841 An issue was discovered in Artifex Ghostscript before 9.24. CVSS 3.0HIGH 7.8
  • TI-2024-16051 freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable… CVSS 3.1HIGH 7.5
See all 265 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences