CVE-2026-103226
Publication date 30 September 2026
Last updated 22 October 2026
Ubuntu priority
Description
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Read the notes from the security team
Why is this CVE low priority?
Compiler hardening makes this a crash in pdfwrite only
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ghostscript | 26.10 stonking |
Fixed in 10.07.1~dfsg-1ubuntu2.1
|
| 26.04 LTS resolute |
Fixed in 10.06.0~dfsg-3ubuntu1.2
|
|
| 24.04 LTS noble |
Fixed in 10.02.1~dfsg1-0ubuntu7.10
|
|
| 22.04 LTS jammy |
Fixed in 9.55.0~dfsg1-0ubuntu5.15
|
|
| 20.04 LTS focal |
Fixed in 9.50~dfsg-5ubuntu4.15+esm3
|
|
| 18.04 LTS bionic |
Fixed in 9.26~dfsg+0-0ubuntu0.18.04.18+esm6
|
|
| 16.04 LTS xenial |
Fixed in 9.26~dfsg+0-0ubuntu0.16.04.14+esm11
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
Severity score breakdown
CVSS version:
Base score
2.1 · Low
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Base score
6.3 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
Related Ubuntu Security Notices (USN)
- USN-8949-1
- Ghostscript vulnerabilities
- 21 October 2026