A flaw was found in Ghostscript. (CVE-2026-101258)

CVE-2026-101258 is a vulnerability in Ghostscript where rendering a specially crafted PostScript or EPS document can bypass the -dSAFER sandbox protection. The flaw involves chaining memory corruption in document parsing with disabling of internal path access controls at runtime, allowing execution of arbitrary shell commands in the context of the Ghostscript process. This can be triggered by delivering the malicious document directly or indirectly through formats that delegate rendering to Ghostscript, such as EPS import or print conversion workflows. The vulnerability affects specific Ubuntu package versions 10.05.0dfsg1-0ubuntu4 and 10.05.0dfsg1-0ubuntu5. The CVSS v3.1 base score is 7.8, reflecting high confidentiality, integrity, and availability impact. No vendor advisory or patch information is provided.

Successful exploitation allows an attacker to execute arbitrary shell commands with the privileges of the Ghostscript process, potentially compromising confidentiality, integrity, and availability of data accessible to that process. This could lead to full system compromise depending on the privileges of Ghostscript. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted PostScript or EPS documents with Ghostscript, especially in workflows that automatically render such files. Monitor vendor channels for updates and apply official patches once released.