CVE-2026-125396

HIGH 7.8

Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery

CVSS Score

7.8

EPSS Score

0.0%

EPSS Percentile

0th

Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code.

CWE	CWE-648
Vendor	artifexsoftware
Product	ghostpdl
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for artifexsoftware ghostpdl

Be the first to know when new high vulnerabilities affecting artifexsoftware ghostpdl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

ArtifexSoftware / ghostpdl

0 < 10.08.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ArtifexSoftware/ghostpdl/commit/1484854e0c8ddfda1baa4ad4cd965b8a9790aa81 github.com: https://github.com/ArtifexSoftware/ghostpdl bugs.ghostscript.com: https://bugs.ghostscript.com/show_bug.cgi?id=709684 github.com: https://github.com/ArtifexSoftware/ghostpdl/blob/ghostpdl-10.07.0/Resource/Init/gs_fonts.ps#L1026-L1035 vulncheck.com: https://www.vulncheck.com/advisories/ghostscript-before-10.08.0-dsafer-bypass-via-putgstringcopy-forceput-recovery

Credits

Paulos Yibelo and pwn.ai Ken Sharp