CVE-2026-112177: 
Ghostscript vulnerability analysis and mitigation

CVE-2026-112177 is a security regression in Ghostscript as shipped with Red Hat Enterprise Linux 8, described as a reintroduction of the .charkeys -dSAFER bypass. The fix for the earlier CVE-2019-14869 was inadvertently omitted when the Ghostscript package was rebased from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure (in Resource/Init/gs_ttf.ps) insufficiently protected. Processing a specially crafted PostScript file can allow an unauthenticated attacker to bypass -dSAFER sandbox restrictions, access files outside permitted paths, or execute commands with the permissions of the Ghostscript process. It was disclosed on October 20, 2026, and carries a CVSS v3.1 base score of 7.3 (High) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-648 (Incorrect Use of Privileged APIs): during the RHEL 8 package rebase from Ghostscript 9.25 to 9.27, three privileged .forceput calls in the .charkeys procedure were reintroduced because the corresponding patch from CVE-2019-14869 was not carried forward (Red Hat Bugzilla). The .forceput operator bypasses PostScript's normal write-protection on dictionaries, and when invoked from within the -dSAFER sandbox context, it can be leveraged to escape sandbox restrictions. The upstream fix, committed to the GhostPDL repository, replaces .forceput with a regular put for TrueType font CharStrings dictionaries (which are not read-only at population time), eliminating the unnecessary privilege escalation path (GhostPDL Commit). Exploitation requires only the ability to supply a crafted PostScript file to a vulnerable Ghostscript process — no authentication or user interaction is needed (Red Hat CVE).

Successful exploitation allows an attacker to bypass Ghostscript's -dSAFER sandbox and either read files outside the permitted paths (confidentiality impact) or execute arbitrary commands with the permissions of the Ghostscript process (integrity and availability impact). Systems that automatically process untrusted PostScript input — such as document-conversion pipelines, print servers, or web services invoking Ghostscript — are particularly exposed, as exploitation requires no privileges or user interaction (Red Hat CVE). Depending on the privileges of the Ghostscript process, an attacker could potentially pivot to broader system access or exfiltrate sensitive data.

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date (Red Hat CVE, Github Advisory). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term (ENISA EUVD). The CVE status is listed as "Received" and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. However, the attack vector is network-accessible with no privileges or user interaction required, and the underlying bypass technique is well-understood from the original CVE-2019-14869, which lowers the barrier for exploitation by knowledgeable attackers.

1. Identify target: Locate systems running Ghostscript as packaged with Red Hat Enterprise Linux 8 (version 9.27 package line), particularly services that automatically process PostScript or PDF files (e.g., document converters, print spoolers, web upload handlers).
2. Craft malicious PostScript file: Construct a PostScript file that invokes the .charkeys procedure in a way that triggers the unprotected .forceput calls, exploiting the missing CVE-2019-14869 patch to write to protected dictionaries and escape the -dSAFER sandbox.
3. Submit the file: Deliver the crafted PostScript file to the target system — for example, by uploading it to a document-conversion service, sending it to a network-accessible print queue, or placing it in a directory monitored by an automated processing pipeline.
4. Bypass sandbox: The .forceput operation executes within the Ghostscript process, bypassing -dSAFER restrictions and granting the attacker the ability to read arbitrary files or execute OS commands.
5. Achieve objective: Use the sandbox escape to exfiltrate sensitive files, write malicious content to the filesystem, or execute commands (e.g., reverse shell) with the permissions of the Ghostscript process (Red Hat CVE, Red Hat Bugzilla).

• File System: Unexpected files created or modified outside normal Ghostscript working directories; new scripts or executables written by the Ghostscript process user account.
• Process: Unusual child processes spawned by the Ghostscript process (e.g., /bin/sh, bash, curl, wget, python) — particularly following processing of a PostScript or PDF file.
• Logs: Ghostscript error logs or application logs showing unexpected file access attempts outside permitted paths; log entries referencing .charkeys or .forceput operations.
• Network: Outbound network connections initiated by the Ghostscript process to unexpected external IP addresses, potentially indicating command execution or data exfiltration following sandbox escape (Red Hat CVE).

Red Hat rates this vulnerability as Important and has identified the affected component as Ghostscript 9.27 in RHEL 8. The upstream fix is available in the GhostPDL repository (commit 485904772c5f0aa1140032746e5a0abfc40f4cef), which removes .forceput from the /.charkeys procedure (GhostPDL Commit). Red Hat has stated that no configuration-based mitigation meeting their deployment criteria is currently available, so users should monitor RHEL 8 errata for an updated Ghostscript package and apply it promptly (Red Hat CVE). As an interim measure, organizations should restrict or disable automatic processing of untrusted PostScript files by Ghostscript, and limit the OS permissions of the Ghostscript process to reduce the impact of potential exploitation.

Red Hat Product Security classified this vulnerability as Important and credited Nicholas Pettas for reporting the issue (Red Hat CVE). The vulnerability was noted as a regression — a reintroduction of a previously patched flaw — which highlights the risk of security fixes being dropped during package rebases, a concern relevant to downstream Linux distributions broadly. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability database aggregation as of the disclosure date.