Artifex Ghostscript CVE-2026-103226

Exploitation requires that a Ghostscript instance process an attacker-controlled document/font through the pdfwrite (vector output) device path that invokes Type1 charstring interpretation - for example a server-side PDF/PostScript conversion service or a user opening/converting a crafted file. The limiting factor is the passive user interaction (UI:P): the victim or an automated pipeline must render the malicious input; there is no purely self-propagating remote trigger. No authentication is required (PR:N). Impact is bounded (partial per SSVC / Low across VC/VI/VA), so realistic outcomes skew toward denial of service or limited corruption rather than guaranteed code execution. Only Ghostscript versions up to 10.09.0 using the affected pdfwrite code path are impacted.

This is a memory-safety flaw (CWE-121 stack-based buffer overflow) in Ghostscript's pdfwrite device, specifically the Type1 charstring subroutine handler (type1_callsubr in devices/vector/gdevpsfx.c). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, base 5.3) describes network-reachable, low-complexity, unauthenticated exploitation but requires passive user/victim interaction (UI:P) - i.e., a target must process an attacker-supplied file - and rates all three impacts as only Low/partial. That partial technical impact is consistent with a stack overflow in a font-parsing loop most plausibly yielding a crash/DoS or bounded corruption rather than reliable arbitrary code execution. The signals are mildly conflicting: a public exploit is available (VulDB, with an attachment on Ghostscript's Bugzilla #709672) and the CVSS carries E:P, yet SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial, and there is no CISA KEV listing and no EPSS value provided. Net read: a genuine, patch-worthy bug in very widely deployed software, but its real-world priority is moderate - the requirement to induce a victim to render a crafted font/PDF (UI:P) plus the bounded impact keep it below a drop-everything emergency. The exploit's public availability is the main reason to patch promptly rather than defer.

An attacker crafts a malicious PostScript/PDF or Type1 font whose charstream triggers an out-of-bounds subroutine index in type1_callsubr, then delivers it to a victim or a server-side conversion pipeline (e.g., a print/PDF-generation service using Ghostscript's pdfwrite device). When the file is processed the stack buffer overflows, crashing the interpreter or corrupting memory. A public proof-of-concept exists as an attachment on the Ghostscript Bugzilla report, lowering the barrier to reproduction.