Vulnerabilitas in software Ghostscript

CVE ID

CVE-2026-19547

Publication date

29 Septembris 2026

Vendor

Artifex Software Inc.

Product

Ghostscript

Vulnerable versions

Omnes ante 10.08.0

Vulnerability type (CWE)

Incertum Iter Quaerere (CWE-426)

Report source

Relatio ad CERT Polska

Description

CERT Polska relationem de vulnerabilitate in software Ghostscript accepit et in coordinatione eius revelationis participavit.

Vulnerabilitas CVE-2026-19547: Ghostscript pro Windows vulnerabilis est ad escalationem privilegii localis per PostScript resource file hijacking. Propter applicationem quaerentem PostScript resource files in itineribus praedictis sub C:\\gs\\, qui per default in installationibus Windows non existunt, coniunctum cum Windows default ACLs permittentibus quemlibet usorem authentificatum ad directories in radice C:\\ creandas, aggressor qui est usor localis authentificatus potest creare structurae directory exspectatae et malitiosum PostScript file inserere. Cum quisquis usor vel servitium postea Ghostscript currit, file insertum automatice onerat et exequitur cum plenis privilegiis processus Ghostscript. Hoc ad plenam compromissionem contextus processus Ghostscript ducit, necnon ad exsequendum codicem arbitrarium in machina cum privilegiis processus Ghostscript.

Haec quaestio in versione 10.08.0 correcta est.

Credits

Gratias agimus Julian Horoszkiewicz ex Atos Threat Research Center pro responsabili relatione de vulnerabilitate.

Plura de processu revelationis vulnerabilitatis coordinatae apud CERT Polska inveniuntur ad https://cert.pl/en/cvd/.

Vulnerabilitates Relatae

CVE-2026-19547 CVSS 7 HIGH Awaiting Analysis

CVE-2026-19547 - Local Privilege Escalation in Ghostscript for Windows

Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installations, combined with Windows default ACLs allowing any authenticated user to create directories at the root of C:\\, an attacker who is an authenticated local user can create the expected directory structure and plant a malicious PostScript file. When any user or service subsequently runs Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process. This results in full compromise of Ghostscript process context, as well as running arbitrary code on the machine with Ghostscript process privileges. This issue was fixed in version 10.08.0.

Vulnerabilitas in software Ghostscript

Vulnerabilitates Relatae

Plura ex cert.pl