{"id":"CVE-2026-125396","kind":"vulnerability","aliases":["CVE-2026-125396"],"related":[],"title":"Ghostscript: crafted PostScript or PDF escapes -dSAFER and runs code","description":"Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code.","summary":"Ghostscript before 10.08.0 has a -dSAFER bypass in the .putgstringcopy procedure, which calls the privileged .forceput operator without checking operand types. A crafted PostScript or PDF file can trigger a use-after-free across save/restore and execute arbitrary code.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ghostscript","pdf-processing","runtime","self-hosted"],"not_affected_if":["ghostscript-not-installed","no-untrusted-input"],"how_to_check":"- Run `gs --version` on each host or container that renders PostScript or PDF files, and compare against `10.08.0`.\n- Look for Ghostscript in image builds, document converters and PDF pipelines, since it is often bundled as a dependency.","fix":"- Ghostscript: move to `10.08.0` or later.","status":"open","published_at":"2026-11-10T00:17:13+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","triaged_at":"2026-11-10T00:29:51+00:00","updated_at":"2026-11-10T00:29:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T00:29:51Z","model":"claude-haiku-5-5","output":{"fix":"- Ghostscript: move to `10.08.0` or later.","reach":"unknown","title":"Ghostscript: crafted PostScript or PDF escapes -dSAFER and runs code","impact":"high","summary":"Ghostscript before 10.08.0 has a -dSAFER bypass in the .putgstringcopy procedure, which calls the privileged .forceput operator without checking operand types. A crafted PostScript or PDF file can trigger a use-after-free across save/restore and execute arbitrary code.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ghostscript","pdf-processing","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the host processing the document","analyst_note":"","how_to_check":"- Run `gs --version` on each host or container that renders PostScript or PDF files, and compare against `10.08.0`.\n- Look for Ghostscript in image builds, document converters and PDF pipelines, since it is often bundled as a dependency.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-input","ghostscript-not-installed"],"who_is_affected":"Any service that runs Ghostscript on untrusted PostScript or PDF input, such as document converters, thumbnailers, print pipelines and upload handlers, is exposed. Systems that never process external documents with Ghostscript can skip it, though the sources do not say how default -dSAFER settings change exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4646,"output_tokens":571,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125396':13A,16A '-2026':12A,15A '10.08.0':27B,67C 'across':59B,116C 'arbitrari':63B,120C 'attack':89C 'bypass':31B,71C 'call':37B,80C 'caus':110C 'check':43B,86C 'code':10A,64B,121C 'contain':68C 'craft':2A,47B,92C 'custom':106C 'cve':11A,14A 'document':96C 'dsafer':7A,30B,70C 'error':101C,107C 'escap':6A 'execut':62B,119C 'file':51B 'forceput':40B,83C,103C 'free':58B,115C 'ghostscript':1A,17B,25B,65C 'gs_fonts.ps':78C 'handler':108C 'host':24B 'oper':41B,84C 'operand':44B,87C 'pdf':5A,19B,50B,95C 'pdf-process':18B 'postscript':3A,48B,93C 'privileg':39B,82C 'procedur':35B,76C 'process':20B 'putgstringcopi':34B,75C 'recov':102C 'run':9A 'runtim':21B 'save/restore':60B,117C 'self':23B 'self-host':22B 'suppli':91C 'trigger':53B,98C 'type':45B,88C,100C 'use':56B,113C 'use-after-fre':55B,112C 'via':104C 'vulner':72C 'without':42B,85C","nicknames":[],"mitigations":[],"who_affected":"Any service that runs Ghostscript on untrusted PostScript or PDF input, such as document converters, thumbnailers, print pipelines and upload handlers, is exposed. Systems that never process external documents with Ghostscript can skip it, though the sources do not say how default -dSAFER settings change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ghostscript","high","pdfprocessing","runtime","selfhosted"],"campaign_type":null,"search_a":"'-125396':13A,16A '-2026':12A,15A 'code':10A 'craft':2A 'cve':11A,14A 'dsafer':7A 'escap':6A 'ghostscript':1A 'pdf':5A 'postscript':3A 'run':9A","search_b":"'10.08.0':27B 'across':59B 'arbitrari':63B 'bypass':31B 'call':37B 'check':43B 'code':64B 'craft':47B 'dsafer':30B 'execut':62B 'file':51B 'forceput':40B 'free':58B 'ghostscript':17B,25B 'host':24B 'oper':41B 'operand':44B 'pdf':19B,50B 'pdf-process':18B 'postscript':48B 'privileg':39B 'procedur':35B 'process':20B 'putgstringcopi':34B 'runtim':21B 'save/restore':60B 'self':23B 'self-host':22B 'trigger':53B 'type':45B 'use':56B 'use-after-fre':55B 'without':42B","search_c":"'10.08.0':67C 'across':116C 'arbitrari':120C 'attack':89C 'bypass':71C 'call':80C 'caus':110C 'check':86C 'code':121C 'contain':68C 'craft':92C 'custom':106C 'document':96C 'dsafer':70C 'error':101C,107C 'execut':119C 'forceput':83C,103C 'free':115C 'ghostscript':65C 'gs_fonts.ps':78C 'handler':108C 'oper':84C 'operand':87C 'pdf':95C 'postscript':93C 'privileg':82C 'procedur':76C 'putgstringcopi':75C 'recov':102C 'save/restore':117C 'suppli':91C 'trigger':98C 'type':88C,100C 'use':113C 'use-after-fre':112C 'via':104C 'vulner':72C 'without':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125396","severity":null,"published_at":"2026-11-10T00:17:13+00:00","modified_at":"2026-11-10T00:17:13+00:00","first_seen_at":"2026-11-10T00:28:44+00:00","fetched_at":"2026-11-10T00:28:44+00:00","note":null}],"documents":[{"id":111591,"url":"https://github.com/ArtifexSoftware/ghostpdl/commit/1484854e0c8ddfda1baa4ad4cd965b8a9790aa81","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111592,"url":"https://www.vulncheck.com/advisories/ghostscript-before-10.08.0-dsafer-bypass-via-putgstringcopy-forceput-recovery","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}