Bug 2544465

Summary: CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: ghostscriptAssignee: Zdenek Dohnal <zdohnal>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: mjg, mosvald, zdohnal
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["df0e7211-06e4-49e0-9628-4d1d58719cdf"]}
Fixed In Version: ghostscript-10.06.0-3.fc44 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-10-21 01:14:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2543939    

Description Vladimir Vasilev 2026-10-01 08:12:57 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."

Comment 1 Fedora Update System 2026-10-16 13:49:23 UTC
FEDORA-2026-b90bfa1339 (ghostscript-10.07.1-3.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-b90bfa1339

Comment 2 Fedora Update System 2026-10-16 14:00:07 UTC
FEDORA-2026-cf31315f93 (ghostscript-10.06.0-3.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-cf31315f93

Comment 3 Fedora Update System 2026-10-16 14:09:48 UTC
FEDORA-2026-58a572baa1 (ghostscript-10.05.1-7.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-58a572baa1

Comment 4 Fedora Update System 2026-10-17 01:56:18 UTC
FEDORA-2026-b90bfa1339 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-b90bfa1339`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b90bfa1339

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-10-17 02:26:24 UTC
FEDORA-2026-cf31315f93 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-cf31315f93`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-cf31315f93

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-10-17 02:49:05 UTC
FEDORA-2026-58a572baa1 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-58a572baa1`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-58a572baa1

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-10-21 01:14:21 UTC
FEDORA-2026-cf31315f93 (ghostscript-10.06.0-3.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.