CVE-2026-19547: 
Ghostscript vulnerability analysis and mitigation

CVE-2026-19547 is a local privilege escalation vulnerability in Ghostscript for Windows caused by PostScript resource file hijacking via predictable, uncontrolled search paths. Ghostscript searches for PostScript resource files under C:\gs\ — a directory that does not exist by default on Windows — while Windows default ACLs permit any authenticated user to create directories at the root of C:\. This allows a low-privileged local attacker to plant a malicious PostScript file that is automatically loaded and executed when any user or service runs Ghostscript. The vulnerability affects all Ghostscript versions prior to 10.08.0 and was disclosed on September 29, 2026. It carries a CVSS v3.1 score of 7.3 (High) and a CVSS v4.0 score of 7.0 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-426 (Untrusted Search Path) and CWE-427 (Uncontrolled Search Path Element): Ghostscript resolves PostScript resource files using a predictable, attacker-influenced directory path (C:\gs\) that does not exist by default (Red Hat Advisory, GitHub Advisory). Because Windows default ACLs grant any authenticated user the ability to create directories at the root of C:\, an attacker can pre-create the expected directory structure and place a malicious PostScript file within it. When Ghostscript is subsequently invoked — by any user or automated service — it automatically loads and executes the planted file with the full privileges of the Ghostscript process. A technical write-up and additional details are available from the discovering organization, CERT-PL (CERT-PL Post), and the upstream bug tracker (Ghostscript Bug).

Successful exploitation grants an authenticated local attacker arbitrary code execution with the full privileges of the Ghostscript process, resulting in complete compromise of confidentiality, integrity, and availability within that process context (Red Hat Advisory). If Ghostscript is run by a privileged user or as a system service, the attacker can effectively escalate to those elevated privileges, enabling data exfiltration, system modification, or further lateral movement within the host. The attack does not require any special privileges beyond a standard authenticated local user account, lowering the barrier for exploitation in multi-user or shared Windows environments (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.159%, placing it in the 5th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability was assigned by CERT-PL and is not marked as automatable, as it requires local access and passive user interaction (another user or service must run Ghostscript after the file is planted) (Red Hat Advisory).

1. Reconnaissance: Confirm that the target Windows system has Ghostscript installed in a version prior to 10.08.0 and that the C:\gs\ directory does not already exist.
2. Create directory structure: As any authenticated local user, create the expected PostScript resource directory path under C:\gs\ (e.g., C:\gs\<version>\lib\ or the specific subdirectory Ghostscript searches for resource files).
3. Plant malicious PostScript file: Place a crafted malicious PostScript file (e.g., a .ps file containing arbitrary PostScript commands such as (%pipe%cmd /c ...) run) in the created directory, matching the filename Ghostscript expects to auto-load as a resource.
4. Wait for trigger: Wait for any user or automated service to invoke Ghostscript (e.g., a document conversion service, print spooler integration, or scheduled task).
5. Code execution: Ghostscript automatically loads and executes the planted PostScript file with the full privileges of the invoking process, achieving arbitrary code execution — potentially at elevated privilege if Ghostscript is run by a service or privileged account (Red Hat Advisory, CERT-PL Post).

• File System: Unexpected directories created under C:\gs\ (especially if Ghostscript was not installed to that path); presence of unfamiliar .ps PostScript files in C:\gs\ subdirectories; file creation timestamps inconsistent with legitimate Ghostscript installation.
• Process: Unusual child processes spawned by the Ghostscript process (e.g., cmd.exe, powershell.exe, net.exe) with a parent of gswin64c.exe or gswin32c.exe; Ghostscript processes running under unexpected user accounts.
• Logs: Windows Security Event Log entries (Event ID 4663/4656) showing creation of directories or files under C:\gs\ by non-administrative users; process creation events (Event ID 4688 or Sysmon Event ID 1) showing Ghostscript spawning shells or network tools.
• Network: Outbound connections from Ghostscript processes to external IPs or C2 infrastructure, particularly shortly after Ghostscript is invoked by a service.

Upgrade Ghostscript to version 10.08.0 or later, which resolves the predictable resource search path issue (Red Hat Advisory, GitHub Advisory). As an interim workaround, restrict write permissions on the root of C:\ to prevent non-administrative users from creating the C:\gs\ directory structure. Additionally, monitor for unexpected directory or file creation under C:\gs\ paths and audit which users or services invoke Ghostscript with elevated privileges. Organizations should prioritize patching systems where Ghostscript is run as a service or by privileged accounts, as these represent the highest-impact exploitation scenarios.

The vulnerability was discovered and reported by CERT-PL, which published a dedicated technical post (CERT-PL Post). Red Hat tracked the issue via Bugzilla and assigned it high severity (Red Hat Bugzilla). The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. No significant social media controversy or broad media coverage has been identified beyond standard vulnerability aggregator reporting.