CVE-2026-112177
Received Received - Intake

Ghostscript PostScript File Access Bypass via .forceput

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: redhat-SADP

Description
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112177
EUVD
EUVD-2026-104827

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 8 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-648 The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Ghostscript as shipped with Red Hat Enterprise Linux 8. A correction for CVE-2019-14869 was omitted during an update from version 9.25 to 9.27. This left privileged operations in the .charkeys procedure insufficiently protected, allowing attackers to bypass -dSAFER restrictions by processing a specially crafted PostScript file. This could lead to unauthorized file access or command execution with Ghostscript's permissions.

Detection Guidance

Detecting this vulnerability requires checking the Ghostscript version and configuration on Red Hat Enterprise Linux 8 systems. Use 'rpm -q ghostscript' to verify the installed version. If the system is running version 9.27 without the patch for CVE-2019-14869, it may be vulnerable. Inspect the gs_ttf.ps file in the Resource/Init directory for the presence of .forceput operations in the .charkeys procedure.

Commands to check: rpm -q ghostscript; grep -r '.forceput' /usr/share/ghostscript/9.27/Resource/Init/gs_ttf.ps

Impact Analysis

If you use systems that automatically process untrusted PostScript files, such as document-conversion or printing services, you are at higher risk. Attackers could exploit this to access files outside allowed paths or execute commands with the same permissions as the Ghostscript process. This could lead to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized file access or command execution could result in data breaches, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Red Hat notes no effective mitigation is currently available that meets their criteria for ease of use or stability. Monitor Red Hat's official channels for updates and patches. Consider upgrading to a supported version of Ghostscript that includes the fix. Avoid processing untrusted PostScript files until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112177. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart