Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Ghostscript can be tricked to run code or crash
published 21 days ago
Summary
The Ghostscript packages for AlmaLinux (including the main program, documentation, and related tools) can be exploited when handling specially crafted PDF or PostScript files. An attacker could cause the program to execute unwanted code or cause it to crash, potentially affecting any system that processes such files. Install the latest Ghostscript update from AlmaLinux as soon as possible to protect your systems.
What to do
- Update almalinux ghostscript to version 9.27-19.el8_10.
- Update almalinux ghostscript-doc to version 9.27-19.el8_10.
- Update almalinux ghostscript-tools-dvipdf to version 9.27-19.el8_10.
- Update almalinux ghostscript-tools-fonts to version 9.27-19.el8_10.
- Update almalinux ghostscript-tools-printing to version 9.27-19.el8_10.
- Update almalinux ghostscript-x11 to version 9.27-19.el8_10.
- Update almalinux libgs to version 9.27-19.el8_10.
- Update almalinux libgs-devel to version 9.27-19.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | ghostscript |
< 9.27-19.el8_10 Fix: upgrade to 9.27-19.el8_10
|
| AlmaLinux:8 | almalinux | ghostscript-doc |
< 9.27-19.el8_10 Fix: upgrade to 9.27-19.el8_10
|
| AlmaLinux:8 | almalinux | ghostscript-tools-dvipdf |
< 9.27-19.el8_10 Fix: upgrade to 9.27-19.el8_10
|
| AlmaLinux:8 | almalinux | ghostscript-tools-fonts |
< 9.27-19.el8_10 Fix: upgrade to 9.27-19.el8_10
|
| AlmaLinux:8 | almalinux | ghostscript-tools-printing |
< 9.27-19.el8_10 Fix: upgrade to 9.27-19.el8_10
|
| AlmaLinux:8 | almalinux | ghostscript-x11 |
< 9.27-19.el8_10 Fix: upgrade to 9.27-19.el8_10
|
| AlmaLinux:8 | almalinux | libgs |
< 9.27-19.el8_10 Fix: upgrade to 9.27-19.el8_10
|
| AlmaLinux:8 | almalinux | libgs-devel |
< 9.27-19.el8_10 Fix: upgrade to 9.27-19.el8_10
|
Original advisory text
Important: ghostscript security update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.
Security Fix(es):
* ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)
* ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258)
* ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:83552 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-101258 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-103226 Third Party Advisory
- https://bugzilla.redhat.com/2542396 Third Party Advisory
- https://bugzilla.redhat.com/2543939 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2026-83552.html Vendor Advisory
Timeline
Published15 Oct 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
ALSA-2026:83552 · OSV
Track software like this
Free during beta