5.3
Medium
CVE-2026-103226 A vulnerability was identified in Artifex Ghostscript up to 10.07.0
Description
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ghostscript 10.08 | earliest → < 10.08.0 | 10.08.0 |
| ghostscript | 10.07 | No fix stated |
Other CVEs of ghostscript
The 15 CVEs of ghostscript →
CVE-2025-59798
Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c
4.3
Medium
CVE-2025-59799
Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in…
4.3
Medium
CVE-2025-59800
In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a…
4.3
Medium
CVE-2025-48708
gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization…
4.0
Medium