CVE-2026-19547 is a local privilege escalation vulnerability in Artifex Software Inc.'s Ghostscript for Windows. The vulnerability arises because Ghostscript searches for PostScript resource files in predictable directories under C:\gs\, which do not exist by default. Windows default ACLs permit any authenticated user to create directories at the root of C:\, enabling an attacker to create the expected directory structure and place a malicious PostScript file. When Ghostscript runs, it automatically loads and executes this file with the full privileges of the Ghostscript process, leading to arbitrary code execution. This vulnerability is classified under CWE-426 (Untrusted Search Path) and has a CVSS 4.0 score of 7.0 (high severity). The vulnerability was fixed in Ghostscript version 10.08.0.

An authenticated local attacker can escalate privileges by planting malicious PostScript files in predictable directories that Ghostscript searches. This results in arbitrary code execution with the privileges of the Ghostscript process, potentially leading to full compromise of the affected system context where Ghostscript runs.

Upgrade Ghostscript to version 10.08.0 or later, where this vulnerability is fixed. Until then, restrict authenticated user permissions to prevent creation of directories at the root of C:\ or monitor for unauthorized directory creation under C:\gs\. No other vendor advisory mitigation is provided.