CVE-2026-103226
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability was identified in Artifex Ghostscript up to 10.07.0 in the function type1_callsubr of the file devices/vector/gdevpsfx.c of the Pdfwrite component. The manipulation leads to a stack-based buffer overflow, and remote exploitation is possible. The exploit is publicly available and might be used.
Risk Assessment
A remote attacker can leverage the publicly available exploit to trigger a stack-based buffer overflow, potentially leading to arbitrary code execution or a crash of the document processing process.
Recommendation
Upgrade Ghostscript to version 10.08.0 or later, which addresses this issue.
Other vulnerabilities in Artifex Ghostscript
See all- CVE-2017-11714High
The psi/ztoken.c file in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, allowing remote attackers to cause application crashes or potentially other unspecified impacts via a crafted PostScript document.
- CVE-2017-9835High
The gs_alloc_ref_array function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.
- CVE-2017-7948High
Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document.
- CVE-2023-46751High
An issue in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer.
Original NVD description (English source)
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS