DEBIAN-CVE-2026-125396: Use After Free
Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gsfonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 10.05.1~dfsg-1+deb13u2 - Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 10.08.0~dfsg-1
Event History
Frequently Asked Questions
What access and interaction does exploitation require?
The severity vector indicates local attack access, no privileges required, and user interaction required. The attacker must provide a crafted PostScript or PDF document for Ghostscript to process.
Which Ghostscript versions are affected?
Ghostscript versions before 10.08.0 are affected. The listed software is Debian's ghostscript package.
What is the likely impact if exploitation succeeds?
A successful exploit can use a use-after-free condition across save/restore operations to execute arbitrary code. The provided severity vector rates confidentiality, integrity, and availability impact as high.