Skip to content
Fencer Intel
high 7.8

CVE-2026-101258 json

Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

published last mo. modified 5d ago also EUVD-2026-93982

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:10.02.1-16.el10_2.3
  • Red Hat Red Hat Enterprise Linux 8 0:9.27-19.el8_10
  • Red Hat Red Hat Enterprise Linux 9 0:9.54.0-19.el9_8.3
  • ghostscript Debian 13 10.05.1~dfsg-1+deb13u3
  • ghostscript Debian 14 10.08.0~dfsg-1

debian advisories DEBIAN-CVE-2026-101258

  • ghostscript Ubuntu 22.04 LTS 9.55.0~dfsg1-0ubuntu5.15
  • ghostscript Ubuntu 24.04 LTS 10.02.1~dfsg1-0ubuntu7.10
  • ghostscript Ubuntu 26.10 10.07.1~dfsg-1ubuntu2.1
  • ghostscript Ubuntu 26.04 LTS 10.06.0~dfsg-3ubuntu1.2
  • ghostscript Ubuntu Pro 16.04 LTS 9.26~dfsg+0-0ubuntu0.16.04.14+esm11
  • ghostscript Ubuntu Pro 18.04 LTS 9.26~dfsg+0-0ubuntu0.18.04.18+esm6
  • ghostscript Ubuntu Pro 20.04 LTS 9.50~dfsg-5ubuntu4.15+esm3

ubuntu advisories UBUNTU-CVE-2026-101258

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ghostscript RHEL 9 9.54.0-19.el9_8.3
  • libgs RHEL 9 9.54.0-19.el9_8.3
  • ghostscript RHEL 10.2 10.02.1-16.el10_2.3
  • libgs RHEL 10.2 10.02.1-16.el10_2.3
  • ghostscript RHEL 8 9.27-19.el8_10
  • libgs RHEL 8 9.27-19.el8_10

red hat advisories RHSA-2026:83553RHSA-2026:83551RHSA-2026:83552

  • ghostscript SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 9.52-150000.217.1
  • ghostscript SLES for SAP applications 16.0, SLES 16.0 10.08.0-160000.2.1
  • ghostscript SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.52-23.103.1

suse advisories SUSE-SU-2026:5094-1SUSE-SU-2026:5039-1SUSE-SU-2026:24468-1

  • ghostscript openSUSE Leap 16.0 10.08.0-160000.2.1
  • ghostscript openSUSE Tumbleweed 10.08.0-2.1

opensuse advisories openSUSE-SU-2026:22176-1openSUSE-SU-2026:12128-1

  • ghostscript AlmaLinux 10 10.02.1-16.el10_2.3
  • libgs AlmaLinux 10 10.02.1-16.el10_2.3
  • ghostscript-tools-fonts AlmaLinux 10 10.02.1-16.el10_2.3
  • ghostscript-tools-dvipdf AlmaLinux 10 10.02.1-16.el10_2.3
  • ghostscript-tools-printing AlmaLinux 10 10.02.1-16.el10_2.3
  • ghostscript AlmaLinux 8 9.27-19.el8_10
  • libgs AlmaLinux 8 9.27-19.el8_10
  • ghostscript-x11 AlmaLinux 8 9.27-19.el8_10

almalinux advisories ALSA-2026:83551ALSA-2026:83552ALSA-2026:83553

  • ghostscript Rocky Linux 10 10.02.1-16.el10_2.3
  • ghostscript Rocky Linux 9 9.54.0-19.el9_8.3
  • ghostscript Rocky Linux 8 9.27-19.el8_10

rocky linux advisories RLSA-2026:83551RLSA-2026:83553RLSA-2026:83552

Is CVE-2026-101258 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-101258 updated cvss 7.8

ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free

  • Red Hat Enterprise Linux 6 ghostscript, ghostscript-gtk Red Hat Enterprise Linux 7 libgs, ghostscript, ghostscript-gtk, ghostscript-cups, ghostscript-chinese-zh_CN, ghostscript-chinese-zh_TW, +1 more
    affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.”
  • Red Hat Enterprise Linux AppStream (v. 8) libgs 9.27-19.el8_10, ghostscript 9.27-19.el8_10
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.” RHSA-2026:83552
  • Red Hat Enterprise Linux AppStream (v. 9) libgs 9.54.0-19.el9_8.3, ghostscript 9.54.0-19.el9_8.3
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.” RHSA-2026:83553
  • Red Hat Enterprise Linux AppStream (v. 10) libgs 10.02.1-16.el10_2.3, ghostscript 10.02.1-16.el10_2.3
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.” RHSA-2026:83551
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) ghostscript 9.54.0-19.el9_8.3
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.” RHSA-2026:83553
  • Red Hat Enterprise Linux 6 ghostscript-fonts 5.50-23.2.el6 Red Hat Enterprise Linux 7 ghostscript-fonts 5.50-23.2.el6
    not affected: component not present
  • Red Hat Enterprise Linux AppStream (v. 8) ghostscript-x11 9.27-19.el8_10 Red Hat Enterprise Linux AppStream (v. 9) ghostscript-x11 9.54.0-19.el9_8.3, ghostscript-tools-fonts 9.54.0-19.el9_8.3, ghostscript-tools-dvipdf 9.54.0-19.el9_8.3, ghostscript-tools-printing 9.54.0-19.el9_8.3 Red Hat Enterprise Linux AppStream (v. 10) ghostscript-tools-fonts 10.02.1-16.el10_2.3, ghostscript-tools-printing 10.02.1-16.el10_2.3 Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) ghostscript-tools-fonts 9.54.0-19.el9_8.3, ghostscript-tools-printing 9.54.0-19.el9_8.3 Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ghostscript-tools-dvipdf 10.02.1-16.el10_2.3 Red Hat Enterprise Linux CRB (v. 8) ghostscript-tools-fonts 9.27-19.el8_10, ghostscript-tools-dvipdf 9.27-19.el8_10, ghostscript-tools-printing 9.27-19.el8_10
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last mo.

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.