High severity · published Oct 6, 2026
CVE-2026-101258
Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101258
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101258
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:83551
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:83552
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:83553
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-101258
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2542396
github.com
https://github.com/v12-security/pocs/tree/main/ghostscript
More from Red Hat Enterprise Linux 10
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.5
CVE-2026-34486
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
10.0
CVE-2026-34078
Flatpak has a complete sandbox escape leading to host file access and code execution in the host context
10.0
CVE-2026-4692
Sandbox escape in the Responsive Design Mode component
