# CVE-2026-125396

Ghostscript -dSAFER bypass allows arbitrary code execution via crafted PostScript/PDF

- Page: https://www.vulneraibility.com/cve/CVE-2026-125396
- CVSS: 8.5
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-10)
- Weakness: CWE-648
- Published: 2026-11-09

## Affected versions

- ArtifexSoftware ghostpdl: affected < 10.08.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Arbitrary code execution (use-after-free) and privilege escalation by crafted PostScript/PDF processed by Ghostscript.

## Action

Immediate action required

## Recommendation

Upgrade Ghostscript to 10.08.0+ and block/unpack untrusted PDFs at perimeter

## References

- [patch] https://github.com/ArtifexSoftware/ghostpdl/commit/1484854e0c8ddfda1baa4ad4cd965b8a9790aa81
- [other] https://github.com/ArtifexSoftware/ghostpdl
- [other] https://bugs.ghostscript.com/show_bug.cgi?id=709684
- [other] https://github.com/ArtifexSoftware/ghostpdl/blob/ghostpdl-10.07.0/Resource/Init/gs_fonts.ps#L1026-L1035
- [advisory] https://www.vulncheck.com/advisories/ghostscript-before-10.08.0-dsafer-bypass-via-putgstringcopy-forceput-recovery

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.