CVE-2026-125396 · Runtime
NO FIX YET · SEE WHAT TO DO
Ghostscript before 10.08.0 has a -dSAFER bypass in the .putgstringcopy procedure, which calls the privileged .forceput operator without checking operand types. A crafted PostScript or PDF file can trigger a use-after-free across save/restore and execute arbitrary code.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any service that runs Ghostscript on untrusted PostScript or PDF input, such as document converters, thumbnailers, print pipelines and upload handlers, is exposed. Systems that never process external documents with Ghostscript can skip it, though the sources do not say how default -dSAFER settings change exposure.
Not affected if ghostscript-not-installed, no-untrusted-input
Who cares ghostscript, pdf-processing, self-hosted
gs --version on each host or container that renders PostScript or PDF files, and compare against 10.08.0.10.08.0 or later.Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.