CVE-2026-112177 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat Enterprise Linux 8 systems with Ghostscript installed should assess exposure and prioritize patching. This includes reviewing PostScript file processing, restricting access to sensitive files and commands, and monitoring for suspicious activity. Security teams should also verify the patches and ensure that compensating controls are in place for exposed systems.

Why it matters

CVE-2026-112177 allows attackers to bypass -dSAFER restrictions in Ghostscript, potentially leading to unauthorized file access or command execution. Defenders should prioritize patching and restrict PostScript file processing.

• Potential unauthorized file access outside permitted paths
• Potential execution of commands with elevated privileges
• Need to verify and apply patches for Ghostscript
• Importance of restricting access to sensitive files and commands

Technical summary

The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. This omission allows attackers to bypass -dSAFER restrictions in Ghostscript, potentially leading to unauthorized file access or command execution. The vulnerability affects Ghostscript as shipped with Red Hat Enterprise Linux 8. Defenders should prioritize verifying and applying patches for Ghostscript and restrict PostScript file processing.

Defensive priority

Defenders should prioritize verifying and applying patches for Ghostscript, reviewing PostScript file processing, and restricting access to sensitive files and commands.

Recommended defensive actions

• Verify and apply patches for Ghostscript
• Review PostScript file processing and restrict access to sensitive files and commands
• Monitor for suspicious PostScript file processing activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the flaw in Ghostscript. Red Hat has provided references to their security advisory and bugzilla entry. The vulnerability was introduced due to the omission of a security patch during a software rebase. Defenders should verify the patches and review PostScript file processing to ensure system security.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.