CVE-2026-112177

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112177
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112177.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112177
Published
2026-10-20T07:25:16Z
Modified
2026-10-21T10:30:40Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
Details

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-648"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112177.json"
}
References

Affected packages

Git / github.com/artifexsoftware/ghostpdl

Affected ranges

Type
GIT
Repo
https://github.com/artifexsoftware/ghostpdl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
485904772c5f0aa1140032746e5a0abfc40f4cef
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "485904772c5f0aa1140032746e5a0abfc40f4cef"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
chrisl-test
ghostpdl
ghostpdl-ebuild
ghostpdl-1.*
ghostpdl-1.53
ghostpdl-1.54
ghostpdl-8.*
ghostpdl-8.70
ghostpdl-8.71
ghostpdl-9.*
ghostpdl-9.00
ghostpdl-9.01
ghostpdl-9.02
ghostscript-6.*
ghostscript-6.0
ghostscript-6.01
ghostscript-6.20
ghostscript-6.21
ghostscript-6.22
ghostscript-6.23
ghostscript-6.30
ghostscript-6.31
ghostscript-6.32
ghostscript-6.50
ghostscript-6.60
ghostscript-6.61
ghostscript-6.62
ghostscript-6.63
ghostscript-6.64
ghostscript-7.*
ghostscript-7.00
ghostscript-7.02
ghostscript-7.03
ghostscript-7.04
ghostscript-7.20
ghostscript-7.21
ghostscript-7.22
ghostscript-7.30
ghostscript-7.31
ghostscript-7.32
ghostscript-7.33
ghostscript-8.*
ghostscript-8.00
ghostscript-8.01
ghostscript-8.10
ghostscript-8.11
ghostscript-8.12
ghostscript-8.13
ghostscript-8.14
ghostscript-8.15
ghostscript-8.30
ghostscript-8.31
ghostscript-8.32
ghostscript-8.33
ghostscript-8.50
ghostscript-8.51
ghostscript-8.52
ghostscript-8.53
ghostscript-8.56
ghostscript-8.57
ghostscript-8.60
ghostscript-8.61
ghostscript-8.62
ghostscript-8.63
ghostscript-8.64
ghostscript-8.70
ghostscript-8.71
ghostscript-9.*
ghostscript-9.01
ghostscript-9.02
jbig2dec-0.*
jbig2dec-0.14

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112177.json"