UBUNTU-CVE-2026-125396: Use After Free
Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gsfonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What input must an attacker provide to exploit this issue?
The attacker must be able to supply a crafted PostScript or PDF document that Ghostscript processes. The document triggers a type error in .putgstringcopy and uses a custom error handler to recover the privileged .forceput operator.
Does running Ghostscript with -dSAFER prevent exploitation?
No. The vulnerability is a bypass of -dSAFER, allowing the crafted document to access .forceput and ultimately execute arbitrary code through a use-after-free across save/restore.
Which Ghostscript versions are affected?
Ghostscript versions before 10.08.0 are affected. Upgrading to 10.08.0 or later addresses the affected version range described.
What is the impact if exploitation succeeds?
Successful exploitation can result in arbitrary code execution in the context of the process running Ghostscript.