CVE-2026-101258: 
Ghostscript vulnerability analysis and mitigation

CVE-2026-101258 is a -dSAFER sandbox bypass vulnerability in Ghostscript that allows an attacker to execute arbitrary shell commands by rendering a crafted PostScript or EPS document. The flaw chains a Type 5 shading out-of-bounds heap write (CWE-787) with a procedure-stream use-after-free to disable Ghostscript's internal path access controls at runtime. Affected versions include Ghostscript 10.00.0 through 10.07.1 (confirmed), with RHEL 10 shipping Ghostscript 10.02.1 confirmed vulnerable; RHEL 8 and 9 impact is still under analysis. It was publicly disclosed on October 6, 2026, following a PoC release by V12 Security on September 26, 2026, after a talk at BSides Canberra 2026. The CVSS v3.1 base score is 7.8 (High) (Red Hat CVE, GitHub Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) and involves two chained memory-safety bugs. Bug 1 (Use-After-Free): In psi/zfproc.c, the s_proc_read_continue function stores a procedure's returned string via a raw C assignment without a save/restore write barrier, allowing a global-VM procedure stream to hold a stale reference to a freed local-VM string — enabling a heap information leak that defeats ASLR. Bug 2 (OOB Heap Write): In base/gsshade.c and base/gsfunc3.c, the check_CBFD function validates shading Function output components against an ArrayedOutput wrapper's n field (set to array length) rather than each sub-function's actual output count; a single-element array wrapping a multi-output sub-function passes validation, and at evaluation fn_AdOt_evaluate overruns the color buffer. The exploit chain: (1) UAF leak recovers PIE code and heap pointers; (2) Type 5 shading OOB write overwrites a SubFileDecode stream's read cursor for an arbitrary-read primitive; (3) memory scanning locates gs_lib_ctx_core_t.path_control_active; (4) the shading write sets path_control_active to 0; (5) PostScript %pipe% support executes the attacker's command. A public PoC is available at https://github.com/v12-security/pocs/tree/main/ghostscript (Red Hat Bugzilla, V12 Security PoC).

Successful exploitation achieves full arbitrary shell command execution within the Ghostscript process context, bypassing the -dSAFER sandbox that is intended to restrict file system and process access. This results in high confidentiality, integrity, and availability impact — an attacker can read, modify, or delete any data accessible to the user running Ghostscript, and can spawn arbitrary processes. While Ghostscript typically runs as an unprivileged user, the commands execute with that user's full privileges; SELinux enforcing mode did not prevent exploitation for common domains such as unconfined_t and initrc_t in Red Hat testing. Attack surface is broad because exploitation can be triggered not only by direct document rendering but also through any application that delegates rendering to Ghostscript, including EPS import in office suites (LibreOffice), ImageMagick convert workflows, and print conversion pipelines (Red Hat CVE, V12 Security PoC).

A fully functional public PoC was released by V12 Security on September 26, 2026, at GitHub, including payload generators for PostScript, EPS, EPT, PDF-routed, SVG, ODF, and DOCX delivery formats (V12 Security PoC). The exploit was confirmed working on Ghostscript 10.00.0 through 10.07.1 across Alpine, Arch, Debian, Fedora, and Ubuntu (x86-64); the UAF leak primitive also works on GS 10.06.0 on Fedora, though full exploitation failed on aarch64 due to architecture-specific ABI constants (Red Hat Bugzilla). The EPSS score is approximately 0.15–0.18%, indicating a currently low but non-trivial probability of exploitation in the wild within 30 days (GitHub Advisory). No in-the-wild exploitation or CISA KEV listing has been reported as of the time of disclosure. The vulnerability is not automatable (requires user interaction to open or process a malicious file) (Red Hat CVE).

1. Reconnaissance: Identify targets that process PostScript, EPS, PDF, SVG, ODF, or DOCX files using Ghostscript 10.00.0–10.07.1 on x86-64 Linux — including servers running ImageMagick, LibreOffice, or print conversion pipelines that delegate to gs.
2. Payload generation: Use the V12 Security PoC tool to generate a malicious PostScript payload embedding the exploit chain: python3 build_payload.py --cmd 'id>/tmp/gs_proof'. This produces payloads/poc.ps containing the UAF leak and OOB write primitives.
3. Delivery format selection: Optionally wrap the core exploit in a delivery container appropriate for the target application using python3 package_payloads.py eps --cmd '<command>' (for ImageMagick/office suite EPS import), or pdf, svg, docx, odf for other delegate workflows.
4. Trigger rendering: Deliver the crafted document to the victim or target application. For direct exploitation: gs -q -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pbmraw -r10 -g60x60 -o /dev/null payloads/poc.ps. For indirect exploitation, upload the EPS/DOCX/SVG to a service that processes it through Ghostscript (e.g., an image conversion API or document preview service).
5. Sandbox escape execution: The exploit (1) leaks heap/PIE pointers via the procedure-stream UAF, (2) uses the Type 5 shading OOB write to build an arbitrary-read primitive, (3) locates and zeroes path_control_active in memory, and (4) opens a %pipe% stream to execute the attacker's shell command within the Ghostscript process.
6. Post-exploitation: With command execution as the Ghostscript process user, establish persistence, exfiltrate data, or pivot to other accessible systems (V12 Security PoC, Red Hat Bugzilla).

• Process: Unexpected child processes spawned by gs or ghostscript (e.g., /bin/sh, bash, curl, wget, python3, nc) — particularly with arguments consistent with reverse shells or data exfiltration.
• File System: Unexpected files written to /tmp/ by the Ghostscript process (e.g., /tmp/gs_proof or similar proof-of-execution artifacts); new cron jobs, SSH authorized_keys modifications, or scripts created under the user account running Ghostscript.
• Logs: Application logs (ImageMagick, LibreOffice, print spooler) showing processing of unexpected EPS, PS, SVG, ODF, or DOCX files followed by abnormal exit codes or signal 139 (SIGSEGV) from gs; audit logs showing execve syscalls from the gs process to shell interpreters.
• Network: Outbound connections from the Ghostscript process or its parent application to unexpected external IPs/domains, particularly shortly after document processing events.
• Qualys Detection: Qualys detection ID 6293476 can be used to identify vulnerable Ghostscript installations (Red Hat CVE, V12 Security PoC).

The GhostPDL 10.09.0 source contains apparent fixes for both underlying bugs: a cross-space copy defense and save-ID tracking for the UAF (psi/zfproc.c), and per-sub-function output count validation in check_CBFD (base/gsshade.c) (Red Hat Bugzilla). Red Hat has stated that no mitigation currently meets their standards for usability, deployment, applicability, or stability; blocking ImageMagick's Ghostscript delegate via policy.xml is not practical on RHEL 8/9/10 as the ImageMagick RPM is not shipped on those releases (Red Hat CVE). Recommended actions: (1) Upgrade Ghostscript to 10.09.0 or later when available from your distribution; (2) restrict or disable processing of untrusted PostScript, EPS, SVG, ODF, and DOCX files through Ghostscript-backed pipelines; (3) run Ghostscript in a container or VM with minimal privileges and strict seccomp/AppArmor profiles to limit post-exploitation impact; (4) monitor for Qualys detection ID 6293476 to identify vulnerable hosts.

Red Hat rated the vulnerability as Important severity, noting that while exploitation requires user interaction and Ghostscript typically runs as an unprivileged user, the -dSAFER sandbox bypass is a significant trust violation and SELinux enforcing mode did not prevent exploitation in their testing (Red Hat CVE). The original research was conducted by V12 Security and presented at BSides Canberra 2026, with the PoC publicly released on September 26, 2026 — a coordinated disclosure timeline. Security media coverage appeared on TechJuice highlighting the risk to servers processing PDF/EPS uploads, and the vulnerability was picked up by threat intelligence aggregators including Tenable (Nessus plugin 363674), Qualys (detection ID 6293476), and AUSCERT (ESB-2026.12466). Community discussion on Mastodon via RedPacketSecurity and coverage on undercodetesting.com with a detailed five-stage sandbox escape walkthrough video indicate moderate security community interest.