CVE-2026-103226 in Ghostscript
Summary
by MITRE • 09/30/2026
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability resides within the Artifex Ghostscript software suite, specifically affecting versions up through 10.09.0. The flaw is located in the type1_callsubr function found within the gdevpsfx.c file, which is a core component of the Pdfwrite device driver. This particular module handles the processing and rendering of PostScript Type 1 fonts into PDF output formats. The technical nature of this defect constitutes a stack-based buffer overflow, a critical class of memory corruption vulnerability where data written to a buffer exceeds its allocated boundary on the call stack. In the context of Ghostscript, such an overflow can occur during the parsing of complex font structures or subroutines embedded within PostScript documents. When the application processes these malformed inputs, it fails to adequately validate input lengths before copying them into fixed-size buffers, leading to memory corruption that disrupts normal program flow and allows for arbitrary code execution under specific conditions.
The operational impact of this vulnerability is severe due to its potential for remote exploitation. Although Ghostscript is often used as a local tool for document conversion or rendering, it is frequently integrated into server-side workflows where untrusted documents are processed automatically. An attacker can craft a malicious PostScript file containing specially constructed Type 1 font data that triggers the buffer overflow when parsed by the vulnerable Pdfwrite component. Because remote exploitation is possible, an adversary could potentially execute arbitrary code on the host system running Ghostscript with the privileges of the user or service account executing the application. This capability transforms what might otherwise be a denial-of-service issue into a full compromise scenario, allowing for data exfiltration, lateral movement within a network, or further escalation of privileges depending on the deployment context and security configurations in place.
From a threat intelligence perspective, this vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-121, which defines stack-based buffer overflow as a weakness resulting from writing data beyond the bounds of a fixed-length stack buffer. Furthermore, the exploitation technique maps to MITRE ATT&CK tactics related to Initial Access and Execution, specifically techniques that leverage software vulnerabilities for remote code execution. The fact that an exploit is publicly available significantly elevates the risk profile, as it lowers the barrier to entry for attackers who may not possess advanced reverse-engineering skills. This public availability increases the likelihood of automated scanning and opportunistic attacks against systems running unpatched versions of Ghostscript across various industries including publishing, legal services, and enterprise document management platforms that rely on robust PDF generation capabilities.
To mitigate this risk, immediate action is required to update the affected software components. The vendor has implemented a solution by modifying how font parsing loops handle subroutine calls, specifically choosing to use defined macros within the loop structure rather than directly in the callsubr function itself. This approach better aligns with standard usage patterns and ensures that bounds checking or safe handling mechanisms are applied consistently during the critical phases of font processing. Organizations should prioritize patching their Ghostscript installations to version 10.09.1 or later, depending on the specific release notes confirming this fix is included. Additionally, implementing defense-in-depth strategies such as input validation at application boundaries, restricting file upload permissions for untrusted users, and employing sandboxed execution environments can provide additional layers of protection against exploitation attempts while patching efforts are completed. Regular monitoring of vendor security advisories remains essential to stay informed about subsequent updates or related vulnerabilities in the Ghostscript ecosystem.