Description
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Published: 2026-09-30
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Exploitation
Action: Immediate Patch
AI Analysis

Impact

A stack‑based buffer overflow exists in the type1_callsubr function of the Pdfwrite device (devices/vector/gdevpsfx.c) in Artifex Ghostscript. The vulnerability allows an attacker to trigger a stack overrun by providing a crafted PDF, and the CVE states that remote exploitation of the attack is possible. The impact includes potential remote exploitation of the system, although the exact scope of damage is not detailed in the description.

Affected Systems

The vulnerability affects Artifex Ghostscript versions up to 10.09.0. It is present in the Pdfwrite component that processes PDF files. No other products are listed, and affected versions are identified only as "up to 10.09.0".

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. The description states that remote exploitation is possible and that the exploit is publicly available, implying that an attacker could trigger the overflow by sending a malicious PDF to any service or user that invokes Ghostscript. The lack of an EPSS score limits precise risk quantification, but the presence of a public exploit suggests that the potential for real‑world attacks is non‑negligible.

Generated by OpenCVE AI on October 1, 2026 at 02:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Ghostscript to a version that includes the official patch addressing the buffer overflow in type1_callsubr.
  • If upgrading is not immediately possible, disable the Pdfwrite device or restrict PDF processing for untrusted sources, limiting the exposure of the vulnerable function.
  • Monitor logs for abnormal PDF parsing activity and use security controls to block repeated or suspicious PDF processing attempts.

Generated by OpenCVE AI on October 1, 2026 at 02:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6550-1 ghostscript security update
History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage." A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
References

Thu, 01 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 30 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Title Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow
First Time appeared Artifex
Artifex ghostscript
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*
Vendors & Products Artifex
Artifex ghostscript
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Artifex Ghostscript
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T16:16:29.137Z

Reserved: 2026-09-30T07:39:52.039Z

Link: CVE-2026-103226

cve-icon Vulnrichment

Updated: 2026-09-30T14:24:52.891Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T15:22:25.663

Modified: 2026-10-15T17:17:10.480

Link: CVE-2026-103226

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-30T14:15:06Z

Links: CVE-2026-103226 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T03:00:15Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

  • CWE-787

    Out-of-bounds Write