CVE catalog

CVE-2026-103226

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.52% · Oct 22, 2026

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianghostscriptsid10.08.0~dfsg-2fixed
Debianghostscriptforky10.08.0~dfsg-2fixed
Debianghostscripttrixie10.05.1~dfsg-1+deb13u1vulnerable
Debianghostscripttrixie-security10.05.1~dfsg-1+deb13u3fixed
Debianghostscriptbookworm10.0.0~dfsg-11+deb12u8vulnerable
Debianghostscriptbookworm-security10.0.0~dfsg-11+deb12u8vulnerable
Ubuntughostscriptpro9.27~dfsg+0-0ubuntu3vulnerable
Ubuntughostscriptpro9.27~dfsg+0-0ubuntu4vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu1vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu2vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu3vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.1vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.2vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.3vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.4vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.5vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.6vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.7vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.8vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.9vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.10vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.11vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.12vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.13vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.14vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.15vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.15+esm1vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.15+esm2vulnerable
Ubuntughostscriptpro9.50~dfsg-5ubuntu4.15+esm3vulnerable
Ubuntughostscript22.049.54.0~dfsg1-0ubuntu2vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu4vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.1vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.2vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.3vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.4vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.5vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.6vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.7vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.9vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.10vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.11vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.12vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.13vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.14vulnerable
Ubuntughostscript22.049.55.0~dfsg1-0ubuntu5.15vulnerable
Ubuntughostscript24.0410.01.2~dfsg1-0ubuntu2vulnerable
Ubuntughostscript24.0410.01.2~dfsg1-0ubuntu2.1vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu1vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu2vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu5vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu6vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7.1vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7.3vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7.4vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7.5vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7.6vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7.7vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7.8vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7.9vulnerable
Ubuntughostscript24.0410.02.1~dfsg1-0ubuntu7.10vulnerable
Ubuntughostscript26.1010.06.0~dfsg-3ubuntu1vulnerable
Ubuntughostscript26.1010.07.1~dfsg-1ubuntu1vulnerable
Ubuntughostscript26.1010.07.1~dfsg-1ubuntu2vulnerable
Ubuntughostscript26.1010.07.1~dfsg-1ubuntu2.1vulnerable
Ubuntughostscript26.0410.05.0dfsg1-0ubuntu4vulnerable
Ubuntughostscript26.0410.05.0dfsg1-0ubuntu5vulnerable
Ubuntughostscript26.0410.06.0~dfsg-3ubuntu1vulnerable
Ubuntughostscript26.0410.06.0~dfsg-3ubuntu1.1vulnerable
Ubuntughostscript26.0410.06.0~dfsg-3ubuntu1.2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianghostscriptsourcesid10.08.0~dfsg-1not yet assignedNot reportedNot reported
Debianghostscriptsourceforky10.08.0~dfsg-1not yet assignedNot reportedNot reported
Debianghostscriptsourcetrixie10.05.1~dfsg-1+deb13u3not yet assignedNot reportedNot reported
Debianghostscriptsourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ghostscript]Affected
    Details (4)

    • 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

  • [ghostscript-doc]Affected

    Source package: [ghostscript]

    Details (4)

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

  • [ghostscript-x]Affected

    Source package: [ghostscript]

    Details (4)

    • 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

  • [libgs10]Affected

    Source package: [ghostscript]

    Details (4)

    • 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

  • [libgs10-common]Affected

    Source package: [ghostscript]

    Details (4)

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

  • [libgs9-common]Affected

    Source package: [ghostscript]

    Details (4)

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

  • [libgs-common]Affected

    Source package: [ghostscript]

    Details (4)

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · all · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

  • [libgs-dev]Affected

    Source package: [ghostscript]

    Details (4)

    • 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

    • 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm-security

      Affected

      nvd · ghostscript · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]