Ghostscript EUVD-2026-88701

Requires local access as any authenticated Windows user to the target machine, and depends on Windows default ACLs that permit authenticated users to create directories at the root of C:\ (so the attacker can create C:\gs\ and subpaths, which do not exist by default). Exploitation only succeeds on Windows installations of Ghostscript versions prior to 10.08.0, and code execution is triggered passively - it fires only when another user or service subsequently runs Ghostscript, so the payload's privilege gain is bounded by whatever principal invokes Ghostscript. It is not remotely exploitable and requires no special Ghostscript configuration, only that the C:\gs\ path is unpopulated (the default).

This is a CWE-426 untrusted search path local privilege escalation in Ghostscript for Windows. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H, base 7.0) indicates local attack vector, low attack complexity, low privileges (any authenticated local user), and passive user interaction - meaning the payload only fires when some other user or service later runs Ghostscript. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The real risk is moderate and situational: the technique is trivially reliable (Windows default ACLs let any authenticated user create C:\gs\, and Ghostscript searches that predictable path), but it is not remotely reachable and its value depends entirely on a higher-privileged user or service (e.g. a SYSTEM print/conversion service) subsequently invoking Ghostscript. This is a credible post-compromise escalation primitive rather than an internet-facing emergency; the 7.0 'high' rating is consistent with a locally-triggered but impactful flaw. Note the 'RCE' tag overstates reachability - code execution is local, gated behind local access plus victim execution, not remote.

An attacker with an ordinary authenticated local account creates the C:\gs\ directory tree (permitted by default Windows root ACLs) and plants a malicious PostScript resource file where Ghostscript expects it. When a higher-privileged user or a service account later runs Ghostscript - for example a document-conversion or print service - the planted file is auto-loaded and executed with that process's privileges, yielding privilege escalation or code execution. No public proof-of-concept is referenced in the provided data.