CVE-2026-103226 Artifex CVE debrief

Who should care

Defenders responsible for systems using Artifex Ghostscript, particularly those processing PostScript or PDF files from untrusted sources, should assess exposure and prioritize upgrading to version 10.08.0 or later.

Why it matters

CVE-2026-103226 is a stack-based buffer overflow vulnerability in Artifex Ghostscript that can be exploited remotely. Defenders should prioritize upgrading to version 10.08.0 or later and assess exposure of systems using affected Ghostscript versions.

• Remote code execution is possible, requiring immediate attention
• Exposure of sensitive data or system compromise may occur
• Defenders must verify and upgrade affected Ghostscript installations
• System crashes or instability may result from exploitation attempts

Technical summary

The `type1_callsubr` function in `devices/vector/gdevpsfx.c` of Artifex Ghostscript up to version 10.07.0 is vulnerable to a stack-based buffer overflow. This issue can be exploited remotely, and a public exploit is available. The vulnerability is addressed in Ghostscript version 10.08.0. The affected function is part of the Pdfwrite component, which handles PostScript and PDF file processing. Successful exploitation could lead to remote code execution or system compromise. Defenders should prioritize upgrading to Ghostscript version 10.08.0 or later to mitigate this vulnerability. Systems using affected versions of Ghostscript should be assessed for exposure

Defensive priority

Defenders should prioritize upgrading to Ghostscript version 10.08.0 or later to mitigate this vulnerability. Systems using affected versions of Ghostscript should be assessed for exposure, particularly those processing PostScript or PDF files from untrusted sources.

Recommended defensive actions

• Upgrade to Ghostscript version 10.08.0 or later
• Assess systems using affected versions of Ghostscript for exposure
• Monitor for and restrict processing of PostScript or PDF files from untrusted sources
• Verify and upgrade affected Ghostscript installations
• Track exceptions and retest remediated assets
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program record and NVD detail page provide official information on this vulnerability. Additional details are available from supplemental sources, including VulDB entries and issue tracking reports from Ghostscript.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.