REDHAT-BUG-2555564: High severity redhat/ghostscript vulnerability

Published Oct 19, 2026

Updated

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The fix for CVE-2019-14869 was omitted when the package was rebased from version 9.25 to 9.27, reintroducing three privileged .forceput calls in the .charkeys procedure in Resource/Init/gsttf.ps. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

Affected Software

1 affected component

redhat/ghostscript=9.27

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ghostscript to a version that resolves this vulnerability.
Patch CVE-2019-14869

Event History

Oct 19, 2026

Data Sourced

via Red Hat·12:28 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The issue affects Ghostscript as shipped with Red Hat Enterprise Linux 8, where the CVE-2019-14869 fix was omitted during a rebase from version 9.25 to 9.27.

What must an attacker do to exploit it?

An attacker needs to cause Ghostscript to process a specially crafted PostScript file. Successful exploitation can bypass -dSAFER restrictions, allowing file access outside permitted paths or command execution with the Ghostscript process's permissions.