CVE-2026-19547: Local Privilege Escalation in Ghostscript for Windows
Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installations, combined with Windows default ACLs allowing any authenticated user to create directories at the root of C:\\, an attacker who is an authenticated local user can create the expected directory structure and plant a malicious PostScript file. When any user or service subsequently runs Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process. This results in full compromise of Ghostscript process context, as well as running arbitrary code on the machine with Ghostscript process privileges.
This issue was fixed in version 10.08.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostscript for Windowsto a version that resolves this vulnerability.Fixed in 10.08.0
Event History
Frequently Asked Questions
Who can exploit this issue, and what must occur for it to result in privilege escalation?
An authenticated local user can create the predictable resource directory structure under C:\gs\ and place a malicious PostScript file there. Escalation occurs when another user or service runs Ghostscript and it automatically loads the planted file; the code then runs with that Ghostscript process's privileges.
Are default Windows installations affected?
The issue relies on expected paths under C:\gs\ not existing by default and on default Windows ACLs permitting authenticated users to create directories at the root of C:\. This allows a local authenticated user to prepare the hijack path before Ghostscript is run.
How can I determine whether a system may already be exposed or tampered with?
Check whether the installed Ghostscript for Windows version is older than 10.08.0, and inspect C:\gs\ for unexpected directory structures or PostScript resource files. In particular, files created by untrusted local users in Ghostscript resource search paths may indicate an attempted hijack.
What mitigation is available if an immediate upgrade is not possible?
Restrict untrusted local users from creating the relevant directories and files under C:\gs\, and remove any untrusted content already present there. Avoid running Ghostscript in elevated or service contexts where possible until version 10.08.0 can be deployed.