Ghostscript: -dSAFER bypass in .putgstringcopy procedure (CVE-2026-125396)

Ghostscript before version 10.08.0 is vulnerable to a -dSAFER bypass in the .putgstringcopy procedure located in gs_fonts.ps. The vulnerability arises because the procedure calls the privileged .forceput operator without validating operand types. An attacker can supply a specially crafted PostScript or PDF document that triggers a deliberate type error. By recovering the .forceput operator through a custom error handler, an attacker can manipulate memory to trigger a use-after-free condition during save and restore operations, leading to arbitrary code execution within the context of the Ghostscript interpreter.

Impact

Successful exploitation allows for arbitrary code execution in the context of the user or service running the Ghostscript interpreter. This is critical for applications that process untrusted user-supplied PostScript or PDF files (e.g., print servers, document converters, or automated imaging pipelines).

Recommendation

• Update all installations of Ghostscript to version 10.08.0 or later immediately.
• Audit applications that integrate Ghostscript to identify and isolate processing of untrusted document inputs.
• Implement sandboxing for the Ghostscript process to limit the impact of potential code execution if immediate patching is not possible.