CVE-2026-103226
Publication date 2 October 2026
Last updated 2 October 2026
Ubuntu priority
Description
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ghostscript | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
Severity score breakdown
CVSS version:
Base score
2.1 · Low
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Base score
6.3 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-103226
- https://bugs.ghostscript.com/show_bug.cgi?id=709672
- https://artifex.com/
- https://bugs.ghostscript.com/attachment.cgi?id=28495
- https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3
- https://vuldb.com/cve/CVE-2026-103226
- https://vuldb.com/submit/955016
- https://vuldb.com/vuln/411906
- https://vuldb.com/vuln/411906/cti