CVE-2026-103226: Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Other sources
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 10.05.1~dfsg-1+deb13u3Fixed in 10.08.0~dfsg-2 - Upgrade
Upgrade
Artifex Ghostscriptto a version that resolves this vulnerability.Fixed in 10.08.0
Event History
Frequently Asked Questions
Which installations should be prioritized for remediation?
Artifex Ghostscript installations up to and including version 10.09.0 should be prioritized, particularly where the Pdfwrite component processes remotely supplied content. Remote exploitation is possible, and a public exploit is available.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates that no privileges are required, but user interaction is required. The attack vector is network-based and attack complexity is low.
What is the recommended mitigation?
Install the available patch. The described fix changes the font-parsing loop to use a defined macro rather than applying it in the type1_callsubr function.