Ghostscript -dSAFER Bypass Vulnerability in Artifex Software Product
CVE-2026-125396

8.5HIGH

Key Information:

Vendor

Artifexsoftware

Status
Ghostpdl
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125396?

Ghostscript versions prior to 10.08.0 are susceptible to a -dSAFER bypass vulnerability stemming from improper operand type checks within the .putgstringcopy procedure located in gs_fonts.ps. This flaw permits attackers to craft malicious PostScript or PDF documents that can invoke a type error. Through clever exploitation, attackers may recover the .forceput operator via a custom error handler, leading to a use-after-free condition during the save/restore process, ultimately allowing the execution of arbitrary code.

Affected Version(s)

ghostpdl 0 < 10.08.0

References

https://github.com/ArtifexSoftware/ghostpdl/commit/148485...
patch
https://github.com/ArtifexSoftware/ghostpdl
product
https://bugs.ghostscript.com/show_bug.cgi?id=709684
issue-tracking

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Paulos Yibelo and pwn.ai
Ken Sharp
.