Home / mailings

PDF

[USN-8949-1] Ghostscript vulnerabilities

Posted on 21 October 2026
Ubuntu Security

==========================================================================Ubuntu Security Notice USN-8949-1
October 21, 2026

ghostscript vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.10
- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Ghostscript.

Software Description:
- ghostscript: PostScript and PDF interpreter

Details:

Rick de Jager discovered that Ghostscript incorrectly handled memory
under certain circumstances when processing PostScript documents. If a
user or automated system were tricked into processing a specially crafted
document, an attacker could possibly use this issue to bypass the sandbox
and execute arbitrary code. (CVE-2026-101258)

It was discovered that Ghostscript incorrectly handled memory when
converting certain fonts. If a user or automated system were tricked into
processing a specially crafted file, an attacker could possibly use this
issue to cause Ghostscript to crash, or possibly execute arbitrary code.
(CVE-2026-103226)

Paulos Yibelo discovered that Ghostscript did not properly validate
certain operands when loading fonts. If a user or automated system were
tricked into processing a specially crafted file, an attacker could
possibly use this issue to bypass the sandbox and execute arbitrary code.
(No CVE number)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.10
libgs10 10.07.1~dfsg-1ubuntu2.1
libgs10-common 10.07.1~dfsg-1ubuntu2.1

Ubuntu 26.04 LTS
libgs10 10.06.0~dfsg-3ubuntu1.2
libgs10-common 10.06.0~dfsg-3ubuntu1.2

Ubuntu 24.04 LTS
libgs10 10.02.1~dfsg1-0ubuntu7.10
libgs10-common 10.02.1~dfsg1-0ubuntu7.10

Ubuntu 22.04 LTS
libgs9 9.55.0~dfsg1-0ubuntu5.15
libgs9-common 9.55.0~dfsg1-0ubuntu5.15

Ubuntu 20.04 LTS
libgs9 9.50~dfsg-5ubuntu4.15+esm3
Available with Ubuntu Pro
libgs9-common 9.50~dfsg-5ubuntu4.15+esm3
Available with Ubuntu Pro

Ubuntu 18.04 LTS
libgs9 9.26~dfsg+0-0ubuntu0.18.04.18+esm6
Available with Ubuntu Pro
libgs9-common 9.26~dfsg+0-0ubuntu0.18.04.18+esm6
Available with Ubuntu Pro

Ubuntu 16.04 LTS
libgs9 9.26~dfsg+0-0ubuntu0.16.04.14+esm11
Available with Ubuntu Pro
libgs9-common 9.26~dfsg+0-0ubuntu0.16.04.14+esm11
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-8949-1
https://bugs.launchpad.net/bugs/2171528
CVE-2026-101258, CVE-2026-103226

Package Information:
https://launchpad.net/ubuntu/+source/ghostscript/10.07.1~dfsg-1ubuntu2.1
https://launchpad.net/ubuntu/+source/ghostscript/10.06.0~dfsg-3ubuntu1.2
https://launchpad.net/ubuntu/+source/ghostscript/10.02.1~dfsg1-0ubuntu7.10
https://launchpad.net/ubuntu/+source/ghostscript/9.55.0~dfsg1-0ubuntu5.15

--===============6927966306495683985==Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature

 

TOP