EUVD-2026-93982
GHSA-g96p-c3cq-wp28
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious file must be rendered locally (AV:L) and a victim/pipeline must process it (UI:R); no privileges needed (PR:N); sandbox escape to shell execution yields full C/I/A impact within the process.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.
AnalysisAI
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript or EPS document, chaining memory corruption in document parsing with a runtime bypass of the -dSAFER sandbox. The flaw affects Ghostscript as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and the assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning no privileges are required but a victim or automated pipeline must render the malicious file, with the malicious document first reaching the processing system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a crafted PostScript or EPS document be rendered by Ghostscript on the target host - directly opened, imported as EPS, or processed by a format/print-conversion workflow that delegates to Ghostscript (including common server-side pipelines such as PDF conversion or ImageMagick thumbnailing). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a CVSS-inflated one, but its risk profile is nuanced. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch with an exact fixed version is identified in the provided data at time of analysis; monitor https://access.redhat.com/security/cve/CVE-2026-101258 and https://bugzilla.redhat.com/show_bug.cgi?id=2542396 for Red Hat Ghostscript errata and update packages as soon as they are published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every system running Ghostscript - including RHEL 6, 7, 8, 9, and 10 hosts, container base images, and any third-party application that embeds it (ImageMagick, print/scan services, document converters, mail gateways) - and treat -dSAFER as non-protective, since this CVE explicitly bypasses it; in parallel, disable or block automated rendering of PostScript and EPS input at all ingress points where possible and begin monitoring for unexpected child processes, shell invocation, or outbound connections from rendering services. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today