Red Hat Enterprise Linux 8 Ghostscript: Sandbox bypass via .charkeys -dSAFER
Summary
Ghostscript as shipped with Red Hat Enterprise Linux 8 lacks the fix for CVE-2019-14869 after a rebase from version 9.25 to 9.27. A specially crafted PostScript file can bypass the -dSAFER restrictions, allowing access to files outside the permitted paths or command execution with the rights of the Ghostscript process. Exploitation requires that an attacker can get such a file processed, for example by document conversion or print services that handle untrusted input.
Affected
- Red Hat Enterprise Linux 8: ghostscript before 9.27-20.el8_10
- Red Hat lists RHEL 6, 7, 9 and 10 as not affected
- Unaffected versions are the default for the other listed RHEL releases per the CVE record
Fixed in
- Red Hat Enterprise Linux 8: ghostscript 9.27-20.el8_10 (RHSA-2026:93978)
- Upstream Artifex fixed release: Unknown.
Workaround
- No vendor workaround available.
- Restrict or stop processing of untrusted PostScript and TrueType font input in document-conversion and printing services.
- Run Ghostscript as an unprivileged user in a restricted container or namespace.
Exploitation
- Not known to be exploited.
- CISA SSVC: Exploitation none, automatable yes, technical impact partial.
- No public proof of concept found.
Our recommendation
- Update ghostscript on all RHEL 8 systems to 9.27-20.el8_10 or later.
- Until patched, limit processing of untrusted PostScript files and restrict the Ghostscript process with SELinux, auditd and EDR monitoring.
- Check whether document or print services on RHEL 8 accept untrusted input.
- Do not rely on -dSAFER as the only control.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat Security Advisory RHSA-2026:93978 access.redhat.com
- Red Hat CVE-2026-112177 access.redhat.com
- Red Hat Bugzilla 2555564 bugzilla.redhat.com
- Upstream fix commit 485904772c5f github.com
- AlmaLinux update issue 4089 github.com
- NVD CVE-2019-14869 nvd.nist.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 01:57.
Original description (NVD)
A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.