Ghostscript vulnerabilities and fixes

CVEs that mention Ghostscript, ranked by priority. 8 tracked.

Ghostscript has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-10-20. Highest priority: CVE-2026-112900 (score 56/100).

• CVE-2026-112900 CRITICAL 9.2 Pillow is a Python imaging library
• CVE-2026-106443 HIGH 8.8 WeasyPrint helps web developers to create PDF documents
• CVE-2026-112177 HIGH 7.3 A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8
• CVE-2026-101258 HIGH 7.8 A flaw was found in Ghostscript
• CVE-2026-77467 HIGH 7.1 Lychee is a free, open-source photo-management tool
• CVE-2026-103226 MEDIUM 6.3 A vulnerability was identified in Artifex Ghostscript up to 10.07.0
• CVE-2026-108693 HIGH 7.0 ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NT
• CVE-2026-19547 HIGH 7.0 Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking

FAQ

How do I fix Ghostscript vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Ghostscript being exploited right now?

None of the tracked Ghostscript CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Ghostscript CVE should I patch first?

CVE-2026-112900 currently ranks highest (56/100): Pillow is a Python imaging library.

← Back to latest CVEs