CVE-2026-125396

Name	CVE-2026-125396
Description	Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6516-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ghostscript (PTS)	bookworm, bookworm (security)	10.0.0~dfsg-11+deb12u8	vulnerable
	trixie	10.05.1~dfsg-1+deb13u1	vulnerable
	trixie (security)	10.05.1~dfsg-1+deb13u3	fixed
	forky, sid	10.08.0~dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ghostscript	source	trixie	10.05.1~dfsg-1+deb13u2		DSA-6516-1
ghostscript	source	(unstable)	10.08.0~dfsg-1

Notes

https://bugs.ghostscript.com/show_bug.cgi?id=709684
Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1484854e0c8ddfda1baa4ad4cd965b8a9790aa81 (ghostpdl-10.08.0)