CVE-2026-103226

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103226", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-30T07:39:52.039Z", "datePublished": "2026-09-30T14:15:06.241Z", "dateUpdated": "2026-10-15T16:16:29.137Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-15T16:16:29.137Z"}, "title": "Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "Stack-based Buffer Overflow"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "Artifex", "product": "Ghostscript", "versions": [{"version": "10.07", "status": "affected"}, {"version": "10.08.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*"], "modules": ["Pdfwrite"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-15T18:21:14.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "zzxzzb (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/411906", "name": "VDB-411906 | Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/411906/cti", "name": "VDB-411906 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-103226", "name": "CVE-2026-103226 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/955016", "name": "Submit #955016 | Artifex Software Ghostscript (GhostPDL) 8.00 (2002) up to 10.09.0 / master (2026-08-21) Stack-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709672", "tags": ["issue-tracking"]}, {"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3", "tags": ["issue-tracking"]}, {"url": "https://bugs.ghostscript.com/attachment.cgi?id=28495", "tags": ["exploit"]}, {"url": "https://ghostscript.com/releases/gsdnld.html", "tags": ["patch"]}, {"url": "https://artifex.com/", "tags": ["product"]}], "tags": ["x_freeware"], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T14:24:46.884908Z", "id": "CVE-2026-103226", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T14:24:57.537Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103226", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T14:24:46.884908Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T14:24:52.891Z"}}], "cna": {"tags": ["x_freeware"], "title": "Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow", "credits": [{"lang": "en", "type": "reporter", "value": "zzxzzb (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*"], "vendor": "Artifex", "modules": ["Pdfwrite"], "product": "Ghostscript", "versions": [{"status": "affected", "version": "10.07"}, {"status": "unaffected", "version": "10.08.0"}]}], "timeline": [{"lang": "en", "time": "2026-09-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-15T18:21:14.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/411906", "name": "VDB-411906 | Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/411906/cti", "name": "VDB-411906 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-103226", "name": "CVE-2026-103226 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/955016", "name": "Submit #955016 | Artifex Software Ghostscript (GhostPDL) 8.00 (2002) up to 10.09.0 / master (2026-08-21) Stack-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709672", "tags": ["issue-tracking"]}, {"url": "https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3", "tags": ["issue-tracking"]}, {"url": "https://bugs.ghostscript.com/attachment.cgi?id=28495", "tags": ["exploit"]}, {"url": "https://ghostscript.com/releases/gsdnld.html", "tags": ["patch"]}, {"url": "https://artifex.com/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "Stack-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-15T16:16:29.137Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103226", "state": "PUBLISHED", "dateUpdated": "2026-10-15T16:16:29.137Z", "dateReserved": "2026-09-30T07:39:52.039Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-30T14:15:06.241Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*"], "modules": ["Pdfwrite"], "product": "Ghostscript", "vendor": "Artifex", "versions": [{"status": "affected", "version": "10.07"}, {"status": "unaffected", "version": "10.08.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: \"I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage.\""}], "id": "CVE-2026-103226", "lastModified": "2026-10-15T17:17:10.480", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103226", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T14:24:46.884908Z", "version": "2.0.3"}}]}, "published": "2026-09-30T15:22:25.663", "references": [{"source": "cna@vuldb.com", "url": "https://artifex.com/"}, {"source": "cna@vuldb.com", "url": "https://bugs.ghostscript.com/attachment.cgi?id=28495"}, {"source": "cna@vuldb.com", "url": "https://bugs.ghostscript.com/show_bug.cgi?id=709672"}, {"source": "cna@vuldb.com", "url": "https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3"}, {"source": "cna@vuldb.com", "url": "https://ghostscript.com/releases/gsdnld.html"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-103226"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/955016"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/411906"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/411906/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-121"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data", "id": "2543939", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543939"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in ghostscript. This vulnerability allows a remote attacker to trigger an application crash leading to a Denial of Service (DoS) or potentially execute arbitrary code by tricking a user or service into processing a specially crafted file. The issue stems from a stack-based buffer overflow in the pdfwrite component during Type 1 font processing."], "name": "CVE-2026-103226", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-09-30T14:15:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103226\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103226\nhttps://artifex.com/\nhttps://bugs.ghostscript.com/attachment.cgi?id=28495\nhttps://bugs.ghostscript.com/show_bug.cgi?id=709672\nhttps://bugs.ghostscript.com/show_bug.cgi?id=709672#c3\nhttps://vuldb.com/cve/CVE-2026-103226\nhttps://vuldb.com/submit/955016\nhttps://vuldb.com/vuln/411906\nhttps://vuldb.com/vuln/411906/cti"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "10.09"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Ghostscript", "source": "cna", "vendor": "Artifex"}, "product": "ghostscript", "vendor": "artifex"}], "created": "2026-09-30T17:15:17.282537+00:00", "updated": "2026-10-01T03:00:15.556945+00:00", "vendors": ["artifex", "artifex$PRODUCT$ghostscript"]}