The vulnerability resides in Ghostscript as deployed in Red Hat Enterprise Linux 8. The fix that addressed a prior CVE‑2019‑14869 was omitted during the rebase from version 9.25 to 9.27. As a result, privileged .forceput operations in the .charkeys procedure are insufficiently protected. Processing a specially crafted PostScript file can bypass the -dSAFER restrictions, allowing an attacker to read or write files outside the permitted paths or execute commands with the permissions of the Ghostscript process. The weakness is classified as CWE‑648: improper restriction of operations within the bounds of a task.

The flaw has been identified in Ghostscript as shipped with Red Hat Enterprise Linux 8. The CNA lists affected RHEL versions 6 through 10, but the description specifically references the RHEL 8 package.

The vulnerability carries a CVSS score of 7.3 and an EPSS score of less than 1 %, indicating that, while the potential impact is significant, the likelihood of exploitation in the wild is currently low. The issue is not listed in the CISA KEV catalog, implying no known exploit code or widespread attacks have been documented. Exploitation would require delivery of a malicious PostScript file to a Ghostscript instance that is executing with elevated privileges or with the -dSAFER flag enabled. An attacker could then read or modify restricted files or spawn arbitrary commands, effectively achieving remote code execution or privilege escalation.