CVE-2026-19547
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. The application searches for resource files in predictable paths under C:\gs\ that do not exist by default, and Windows default ACLs allow any authenticated user to create directories at the root of C:\. An attacker can create the expected directory structure and plant a malicious PostScript file, which is executed with full privileges of the Ghostscript process. Fixed in version 10.08.0.
Risk Assessment
A local attacker can gain full control of the Ghostscript process and execute arbitrary code with its privileges, potentially leading to privilege escalation on the system.
Recommendation
Update Ghostscript to version 10.08.0 or later.
Other vulnerabilities in Ghostscript
See all- CVE-2016-7976High
The PS Interpreter in Ghostscript versions 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.
- CVE-2016-8602High
The .sethalftone5 function in Ghostscript before version 9.21 allows remote attackers to cause application crashes or potentially execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.
- CVE-2016-10317High
The fill_threshhold_buffer function in base/gxht_thresh.c in Ghostscript 9.20 by Artifex Software, Inc. allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.
- CVE-2017-6196High
Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document.
- CVE-2026-39919Critical
Ghostscript before 10.08.0 contains a heap-based buffer overflow in the JPEG 2000 output adapter (base/sjpx_openjpeg.c). An attacker can cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. The issue is fixed in version 10.08.0.
- CVE-2016-7979Critical
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.
- CVE-2016-7978Critical
A use-after-free vulnerability in Ghostscript 9.20 may allow remote attackers to execute arbitrary code via reference leaks in the .setdevice function.
- CVE-2026-112922Low
Ghostscript has improper bounds validation when processing indexed color values in mesh shading data. A remote attacker can entice a user to process a crafted PDF or PostScript document, triggering an out-of-bounds memory read.
- CVE-2026-110133Medium
A flaw was found in Ghostscript. When processing a specially crafted TrueType font or a document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow.
- CVE-2026-112177High
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.
Original NVD description (English source)
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installations, combined with Windows default ACLs allowing any authenticated user to create directories at the root of C:\\, an attacker who is an authenticated local user can create the expected directory structure and plant a malicious PostScript file. When any user or service subsequently runs Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process. This results in full compromise of Ghostscript process context, as well as running arbitrary code on the machine with Ghostscript process privileges. This issue was fixed in version 10.08.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS