Ghostscript EUVD-2026-104827

Exploitation requires that an application or service process an attacker-supplied PostScript/EPS file using an affected RHEL Ghostscript build (the one produced by the 9.25-to-9.27 rebase, notably RHEL 8) while relying on -dSAFER as the protection boundary; the crafted file abuses the insufficiently protected .forceput in the .charkeys procedure to escape that sandbox. Limiting factors: the target must actually feed untrusted PostScript to Ghostscript (automated upload/print/conversion pipelines are the realistic exposure), and defenses depend on -dSAFER being the intended containment - systems that never process untrusted PostScript, or that run unaffected Ghostscript versions, are not exposed. Authentication is not required per the CVSS vector (PR:N).

This is a genuine but conditional priority rather than a drop-everything emergency. The input CVSS vector (AV:N/AC:L/PR:N/UI:N, base 7.3) frames it as a network, low-complexity, unauthenticated issue, which maps to the real-world pattern of server-side pipelines (print/conversion/upload services) automatically rendering attacker-supplied PostScript with Ghostscript under -dSAFER. The decisive risk factor is the nature of the bug: a regression that silently reintroduces CVE-2019-14869 because the fix was dropped during the RHEL 9.25-to-9.27 rebase, leaving .forceput in .charkeys unprotected and permitting a -dSAFER sandbox escape to file access and command execution - CWE-648. Several escalation signals are MISSING or neutral: no EPSS probability was supplied, there is no CISA KEV listing (no confirmed active exploitation), and no public exploit was provided (the referenced GitHub commit is the upstream FIX, not weaponized exploit code). One tension to verify: the vector asserts UI:N, but exploitation realistically depends on some component processing untrusted PostScript - risk concentrates in environments with automated document/image conversion, not in systems that never feed Ghostscript untrusted input. Also note the input impact metrics (C:L/I:L/A:L) look conservative for a description that explicitly allows command execution - see assessed vector below.

An attacker submits a specially crafted PostScript/EPS file to a service that automatically renders it with the vulnerable RHEL Ghostscript build under -dSAFER - for example a web upload, document-conversion, or print pipeline. The file abuses the unprotected privileged .forceput operation in the .charkeys procedure to break out of the SAFER sandbox, reading files outside permitted paths or executing commands as the Ghostscript process user. No public exploit was identified at time of analysis, though the upstream fix commit exposes the vulnerable code path.