Vulnerability · Published Oct 20, 2026 · Assigned by redhat
CVE-2026-112177Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
High 7.3
In plain English
A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | ghostscript | 9.27-20.el8_10 | ALSA-2026:93978 |
| AlmaLinux:8 | ghostscript-doc | 9.27-20.el8_10 | ALSA-2026:93978 |
| AlmaLinux:8 | ghostscript-tools-dvipdf | 9.27-20.el8_10 | ALSA-2026:93978 |
| AlmaLinux:8 | ghostscript-tools-fonts | 9.27-20.el8_10 | ALSA-2026:93978 |
| AlmaLinux:8 | ghostscript-tools-printing | 9.27-20.el8_10 | ALSA-2026:93978 |
| AlmaLinux:8 | ghostscript-x11 | 9.27-20.el8_10 | ALSA-2026:93978 |
| AlmaLinux:8 | libgs | 9.27-20.el8_10 | ALSA-2026:93978 |
| AlmaLinux:8 | libgs-devel | 9.27-20.el8_10 | ALSA-2026:93978 |
| Rocky Linux:8 | ghostscript | 0:9.27-20.el8_10 | RLSA-2026:93978 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-648 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- RHSA-2026:93978 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-112177 vdb-entry, x_refsource_REDHAT
- RHBZ#2555564 issue-tracking, x_refsource_REDHAT
- https://github.com/ArtifexSoftware/ghostpdl/commit/485904772c5f0aa1140032746e5a0abfc40f4cef