Ghostscript Vulnerability in Red Hat Enterprise Linux
CVE-2026-112177
7.3HIGH
What is CVE-2026-112177?
A vulnerability in Ghostscript, as packaged with Red Hat Enterprise Linux 8, arises from the omission of a crucial correction during the transition from version 9.25 to 9.27. This oversight results in inadequate protections for privileged .forceput operations within the .charkeys procedure. An attacker can exploit this flaw by crafting a malicious PostScript file that bypasses -dSAFER restrictions, potentially permitting unauthorized access to files outside designated paths or executing commands with the privileges of the Ghostscript process. This vulnerability underscores the importance of maintaining up-to-date software and ensuring all security measures are effectively implemented.
References
CVSS V3.1
Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Nicholas Pettas for reporting this issue.