Artifex Ghostscript up to 10.7.x PostScript privileges management

Summaryinfo

A vulnerability was found in Artifex Ghostscript up to 10.7.x. It has been rated as problematic. The affected element is an unknown function of the component PostScript Handler. Performing a manipulation results in privileges management. This vulnerability is known as CVE-2026-19547. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Artifex Ghostscript up to 10.7.x. This affects an unknown function of the component PostScript Handler. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installations, combined with Windows default ACLs allowing any authenticated user to create directories at the root of C:\\, an attacker who is an authenticated local user can create the expected directory structure and plant a malicious PostScript file. When any user or service subsequently runs Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process. This results in full compromise of Ghostscript process context, as well as running arbitrary code on the machine with Ghostscript process privileges. This issue was fixed in version 10.08.0.

The advisory is shared at cert.pl. This vulnerability is uniquely identified as CVE-2026-19547 since 08/11/2026. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading to version 10.08.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3628). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Open Source Ghostscript

Productinfo

Type

• Document Processing Software

Vendor

• Artifex

Name

• Ghostscript

Version

• 10.0
• 10.1
• 10.2
• 10.3
• 10.4
• 10.5
• 10.6
• 10.7

License

• free

Website

• Vendor: https://artifex.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion