CVE-2026-112177
7.3HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-648
Impact
Attackers can bypass -dSAFER sandbox protections to access restricted files or execute arbitrary commands as the Ghostscript process. They only need to submit a crafted PostScript file to a service or pipeline running Ghostscript.
Root cause
A previous security fix was dropped during a rebase from 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure exposed.
Affected systems
Ghostscript 9.27 as shipped with Red Hat Enterprise Linux 8.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
Upgrade the ghostscript package to the latest patched Red Hat release once available, or avoid processing untrusted PostScript files until updated.
$ sudo dnf update ghostscriptAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.