{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aartifexghostscript9.27/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:artifex:ghostscript:9.27:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux:8:*:*:*:*:*:*:*","cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*","cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-112177"},{"cvss":8.8,"id":"CVE-2019-14869"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ghostscript (9.27)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","ghostscript","linux"],"_cs_type":"advisory","_cs_vendors":["Artifex Software","Red Hat"],"content_html":"\u003cp\u003eA vulnerability identified as CVE-2026-112177 exists in the Ghostscript package as distributed with Red Hat Enterprise Linux 8. The issue stems from a regression during the transition from version 9.25 to 9.27, where the security mitigations previously implemented for CVE-2019-14869 were inadvertently omitted. Specifically, the .charkeys procedure in Ghostscript 9.27 fails to properly sanitize or restrict the use of the privileged .forceput operator.\u003c/p\u003e\n\u003cp\u003eWhen Ghostscript processes a malicious PostScript document, an attacker can leverage this oversight to bypass the intended -dSAFER sandbox protections. Successful exploitation allows the attacker to read or write files outside of the defined processing directories and potentially execute system commands with the privileges of the user or service running the Ghostscript binary. This represents a significant risk for environments that automatically process untrusted documents, such as print servers, document management systems, or automated PDF conversion pipelines.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this flaw can lead to a full sandbox escape, granting an attacker the ability to perform arbitrary file system operations or execute code within the context of the vulnerable process. This exposes sensitive data on the host system and provides a platform for further lateral movement or privilege escalation within the targeted infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Ghostscript to the latest version provided by Red Hat for RHEL 8, ensuring the re-inclusion of all security patches for CVE-2019-14869.\u003c/li\u003e\n\u003cli\u003eImplement sandboxing or containerization for any processes that utilize Ghostscript to handle user-supplied files, limiting the blast radius of potential escapes.\u003c/li\u003e\n\u003cli\u003eReview and audit system logs for unexpected execution of shell commands originating from document processing services.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T08:33:58Z","date_published":"2026-10-20T08:33:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ghostscript-vulnerability/","summary":"An incomplete security fix in Ghostscript 9.27 on RHEL 8 allows attackers to bypass -dSAFER restrictions, leading to arbitrary file access or command execution via crafted PostScript files.","title":"Ghostscript -dSAFER Bypass via CVE-2026-112177","url":"https://feed.craftedsignal.io/briefs/2026-10-ghostscript-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:artifex:ghostscript:9.27:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}