CVE-2026-112177

HighCVSS 7.3/10Last modified Oct 20, 2026

Description

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-648

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 20, 2026
Last modified
Oct 20, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1121787.1MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or CVE-2026-1121795.3In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of nonCVE-2026-112186.8Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who convincCVE-2026-1121805.1MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed frCVE-2026-1121834.8MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, thCVE-2026-1121844.8MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-moCVE-2026-1121887.1MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration CVE-2026-112194.3Inappropriate implementation in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictioCVE-2026-1121905.3A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composerCVE-2026-1121925.3MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumptiCVE-2026-1121933.7A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/FilamCVE-2026-1121954.7A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/