A memory corruption flaw in Ghostscript allows a crafted PostScript or EPS document to bypass the -dSAFER sandbox flag and subsequently execute arbitrary shell commands in the context of the Ghostscript process. The vulnerability is achieved by an out‑of‑bounds write in type 5 shading, followed by a use‑after‑free of a procedure stream that removes internal path access controls during parsing, thus enabling the escape from the sandbox environment.

The flaw affects Ghostscript runs on Red Hat Enterprise Linux 6, 7, 8, 9 and 10. All versions of the OS package that include Ghostscript prior to the official fix are vulnerable and consequently any system that processes PostScript or EPS files through Ghostscript is at risk.

The CVSS base score of 7.8 classifies the issue as high severity. No EPSS score is reported, so exploitation likelihood remains uncertain; however the vulnerability is listed in Red Hat advisories and is not yet in the CISA KEV catalog. The attack vector most commonly involves the delivery of malicious EPS or PostScript content to a system that employs Ghostscript for rendering, printing, or conversion workflows. Successful exploitation grants full control over the Ghostscript process, enabling an attacker to compromise the confidentiality, integrity, and availability of any data or services that the process can access.