CVE-2026-101258
Publication date 6 October 2026
Last updated 22 October 2026
Ubuntu priority
Description
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ghostscript | 26.10 stonking |
Fixed in 10.07.1~dfsg-1ubuntu2.1
|
| 26.04 LTS resolute |
Fixed in 10.06.0~dfsg-3ubuntu1.2
|
|
| 24.04 LTS noble |
Fixed in 10.02.1~dfsg1-0ubuntu7.10
|
|
| 22.04 LTS jammy |
Fixed in 9.55.0~dfsg1-0ubuntu5.15
|
|
| 20.04 LTS focal |
Fixed in 9.50~dfsg-5ubuntu4.15+esm3
|
|
| 18.04 LTS bionic |
Fixed in 9.26~dfsg+0-0ubuntu0.18.04.18+esm6
|
|
| 16.04 LTS xenial |
Fixed in 9.26~dfsg+0-0ubuntu0.16.04.14+esm11
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialPatch details
| Package | Patch details |
|---|---|
| ghostscript |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
7.8 · High
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8949-1
- Ghostscript vulnerabilities
- 21 October 2026