CVE-2026-125396: Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery
Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gsfonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to get Ghostscript to process a crafted PostScript or PDF document. Exploitation requires user interaction, as reflected by the UI:R vector, but does not require privileges.
Are installations using -dSAFER protected?
No. The vulnerability is specifically a bypass of -dSAFER in affected Ghostscript versions before 10.08.0.
What is the impact if exploitation succeeds?
A successful exploit can cause a use-after-free condition across save/restore and execute arbitrary code. The supplied vector indicates high impact to confidentiality, integrity, and availability.