CVE-2026-103226

Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow

Artifex GhostscriptLibraries & packages

CVSS

5.3Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.52%Chance of exploitation activity in the next 30 days, higher than 43% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published30 Sep 2026Updated 15 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

USN-8949-1: Ghostscript vulnerabilitiesUbuntu security notices, 21 Oct 2026Vendor

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

USN-8949-1: Ghostscript vulnerabilitiesUbuntu security notices, 21 Oct 2026

Description

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."

Text from CVE List

Affected versions 2

Ghostscriptaffected: 10.07CVE List
Ghostscriptunaffected: 10.08.0CVE List