Vulnerability feed

Executive summary

Several security flaws were fixed in Ghostscript, a widely used tool for reading PostScript and PDF files, and Ubuntu has released updated packages for multiple Ubuntu versions. The advisory says an attacker could exploit these flaws if a user or automated system were tricked into processing a specially crafted file or document, and one flaw could potentially allow code execution after escaping the sandbox. The recommended action is to apply a standard system update that includes the fixed package versions listed in the advisory.

Technical summary

The advisory describes memory handling errors in Ghostscript when processing PostScript documents and converting certain fonts, plus improper validation of operands when loading fonts. One issue (CVE-2026-101258) could possibly let an attacker bypass the sandbox and execute arbitrary code, another (CVE-2026-103226) could cause a crash or possibly code execution, and a third has no CVE number listed. Exploitation requires that a user or automated system be tricked into processing a specially crafted file or document. Fixed package versions are given for libgs10 and libgs10-common on 26.10 and 26.04 LTS, libgs10 on 24.04 LTS, libgs9 and libgs9-common on 22.04, 20.04, 18.04 and 16.04 LTS, with the exact version strings as written in the advisory. The advisory does not state any workarounds, detection guidance, CVSS scores, or whether the issues are being exploited in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from ubuntu.com/security/notices/USN-8949-1

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affects

CanonicalGhostscriptCanonical Ubuntu LinuxCanonical UbuntuGhostscript