Back Linuxsecurity

Oracle Linux 9 Ghostscript Severe Buffer Overflow Advisory ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • October 16, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

[9.54.0-19.3] - RHEL-273957 CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data [9.54.0-19.2] - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free via Type 5 shading OOB write and procedure-stream use-after-free

ghostscript-9.54.0-19.el9_8.3.i686.rpm ghostscript-9.54.0-19.el9_8.3.x86_64.rpm ghostscript-doc-9.54.0-19.el9_8.3.noarch.rpm ghostscript-tools-dvipdf-9.54.0-19.el9_8.3.x86_64.rpm ghostscript-tools-fonts-9.54.0-19.el9_8.3.i686.rpm ghostscript-tools-fonts-9.54.0-19.el9_8.3.x86_64.rpm ghostscript-tools-printing-9.54.0-19.el9_8.3.i686.rpm ghostscript-tools-printing-9.54.0-19.el9_8.3.x86_64.rpm ghostscript-x11-9.54.0-19.el9_8.3.x86_64.rpm libgs-9.54.0-19.el9_8.3.i686.rpm libgs-9.54.0-19.el9_8.3.x86_64.rpm libgs-devel-9.54.0-19.el9_8.3.i686.rpm libgs-devel-9.54.0-19.el9_8.3.x86_64.rpm

ghostscript-9.54.0-19.el9_8.3.aarch64.rpm ghostscript-doc-9.54.0-19.el9_8.3.noarch.rpm ghostscript-tools-dvipdf-9.54.0-19.el9_8.3.aarch64.rpm ghostscript-tools-fonts-9.54.0-19.el9_8.3.aarch64.rpm ghostscript-tools-printing-9.54.0-19.el9_8.3.aarch64.rpm ghostscript-x11-9.54.0-19.el9_8.3.aarch64.rpm libgs-9.54.0-19.el9_8.3.aarch64.rpm libgs-devel-9.54.0-19.el9_8.3.aarch64.rpm

Related CVEs: CVE-2026-101258 CVE-2026-103226

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Oracle Ghostscript Buffer Overflow Vulnerabilities Disclosed Oracle has disclosed multiple buffer overflow vulnerabilities in Ghostscript affecting various versions across Oracle Linux 8, 9, and 10. The vulnerabilities, identified as CVE-2026-101258 and CVE-2026-103226, include a stack-based buffer overflow in pdfwrite and a sandbox bypass via Type 5 shading. These flaws could allow remote code execution and have been rated with CVSS scores of 7.8 (high) and 5.3 (medium) respectively. Affected systems include Ghostscript versions 9.27 and 9.54 for Oracle Linux 8 and 9, and version 10.02 for Oracle Linux 10. Patches for these vulnerabilities were released on October 6, 2026, and October 16, 2026, respectively. Administrators are urged to apply the updates promptly to mitigate potential risks. 3 sources 58

Extracted Entities

Oracle Linux 9 Ghostscript Severe Buffer Overflow Advisory ELSA-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (2)

Platforms (1)