CVE-2026-103226: Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Affected Software
Event History
Frequently Asked Questions
Which installations should be prioritized for remediation?
Artifex Ghostscript installations up to and including version 10.09.0 should be prioritized, particularly where the Pdfwrite component processes remotely supplied content. Remote exploitation is possible, and a public exploit is available.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates that no privileges are required, but user interaction is required. The attack vector is network-based and attack complexity is low.
What is the recommended mitigation?
Install the available patch. The described fix changes the font-parsing loop to use a defined macro rather than applying it in the type1_callsubr function.