RLSA-2026:93978: Important: ghostscript security update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.
Security Fix(es):
ghostscript: Reintroduction of .charkeys -dSAFER bypass in Rocky Linux 8 (CVE-2026-112177)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/ghostscriptto a version that resolves this vulnerability.Fixed in 0:9.27-20.el8_10
Event History
Frequently Asked Questions
What systems should be prioritized for remediation?
Rocky Linux 8 systems with Ghostscript installed should be prioritized, especially where the software is reachable through network-exposed document-processing workflows. The advisory identifies a Ghostscript -dSAFER bypass issue specific to Rocky Linux 8.
What does an attacker need to exploit this issue?
The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. It also indicates low confidentiality, integrity, and availability impact.
Can I determine from this advisory whether a host is already patched?
No fixed or affected Ghostscript package versions are provided in this data. Verify the installed Rocky Linux Ghostscript package against the vendor errata for RLSA-2026:93978.