Applications

CVE-2026-125396

Ghostscript -dSAFER bypass allows arbitrary code execution via crafted PostScript/PDF

Major vulnerability. Ghostscript is a widely used PDF/PostScript rendering library; an RCE via SAFER bypass can compromise print servers, mail gateways and document-processing services across organizations.

CVSS: 8.5Highscored by the publisher (CNA)
Exploited in the wild: Not knownnot in CISA KEV as of our last sync
EPSS: No score yet
Fix: Patch availablesee the advisories in the references
Published: 9 Nov 2026analysed here 12 Nov 2026

Summary

Impact

Arbitrary code execution (use-after-free) and privilege escalation by crafted PostScript/PDF processed by Ghostscript.

Triage

Exploitable: At runtime
Attack vector: local
Weakness: CWE-648 Common Weakness
Can a WAF block it?: No. See why

The summary, impact and action text on this page are written by our AI analysis pipeline, or taken from the NVD description when a CVE was imported from NVD. They are not the vendor's wording: check them against the sources. A longer AI executive summary and technical analysis are generated for signed-in accounts on the Max plan.

Affected products

Product	Affected versions	Vendor says fixed in
ArtifexSoftware ghostpdl	< 10.08.0Vendor says fixed in: not stated	Not stated by the vendor

As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.

Products named in our analysis

Ghostscript < 10.08.0
ghostpdl package
Servers/services that process PDFs/PostScript (print servers, mail gateways)

Fix and mitigation

Action required

Immediate action required

WAF and other mitigations

Can a WAF block it? No. The attack needs local access to the machine, so a WAF is not on its path.

Also consider: patch

Based on the attack vector (local or physical access). We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.

Remediation steps (AI-written)

Step-by-step remediation is generated for accounts on the Max plan, for CVEs that match a technology in their stack. Add this technology to your stack to see the fix checklist.

Exploitation evidence

CISA KEV catalog: Not listed as of our last sync.
Public exploit code: None on record in Exploit-DB, Metasploit, Nuclei templates or PoC-in-GitHub.
CISA SSVC: exploitation none, automatable no, technical impact totalAssessed by CISA 10 Nov 2026 (SSVC 2.0.3). Exploitation is none, poc (public proof of concept) or active.

Timeline

9 Nov 2026Published
10 Nov 2026CISA SSVC assessment: exploitation none1 day later
10 Nov 2026CVE record last updatedsame day later
12 Nov 2026Analysed by vulneraibility.com2 days later

Common questions

Is CVE-2026-125396 being exploited?

Not confirmed. CVE-2026-125396 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.

How severe is CVE-2026-125396?

CVE-2026-125396 is rated High with a CVSS score of 8.5. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.

Is there a patch for CVE-2026-125396?

Yes. A fix has been recorded for CVE-2026-125396. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.

What does CVE-2026-125396 affect?

CVE-2026-125396 affects Ghostscript < 10.08.0, ghostpdl package, Servers/services that process PDFs/PostScript (print servers, mail gateways). Confirm the exact affected versions against the vendor advisory before deciding you are exposed.

What should I do about CVE-2026-125396?

Upgrade Ghostscript to 10.08.0+ and block/unpack untrusted PDFs at perimeter

Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.

References

NVD CVE.org CVE Details Source

5 references in the CVE record, grouped by the tags the record gives them.

Advisories (1)

vulncheck.com /advisories/ghostscript-before-10.08.0-dsafer-bypass-via-putgstringcopy-forceput

Patches (1)

github.com /ArtifexSoftware/ghostpdl/commit/1484854e0c8ddfda1baa4ad4cd965b8a9790aa81

Where the data on this page comes from

CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
NVD: CVSS and CPE data
CISA Vulnrichment (ADP): SSVC decision points
FIRST EPSS: exploit probability and percentile

Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.

Similar CVEs

Get CVEs like this by email. Join the free digest: the CVEs we flag as major, all CVSS 8.0 or higher, in up to three emails a day (sent at 05:00, 11:00 and 15:00 UTC). Matching alerts to the products you run needs an account, and accounts are invite-only during the beta.