CVE-2026-103226
MediumCVSS 6.3Summary
Artifex Ghostscript up to 10.09.0 has a stack-based buffer overflow in the function type1_callsubr in devices/vector/gdevpsfx.c of the Pdfwrite component. Remote exploitation is possible, and the exploit is publicly available. A patch is suggested.
Risk Assessment
Buffer overflow can lead to remote code execution or crashes, and the public exploit increases the risk of exploitation.
Recommendation
Install the available patch for Ghostscript. If possible, upgrade to a version that includes the fix described by the vendor.
Other vulnerabilities in Artifex Ghostscript
See all- CVE-2017-11714High
The psi/ztoken.c file in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, allowing remote attackers to cause application crashes or potentially other unspecified impacts via a crafted PostScript document.
- CVE-2017-9835High
The gs_alloc_ref_array function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.
- CVE-2017-7948High
Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document.
Original NVD description (English source)
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS