Zero Radar
← feed
HighVulnerabilityupdated 26 Oct 2026, 11:49 UTC

Ghostscript: remote attackers can run code and tamper with data

Ghostscript is a tool that reads and converts PDF and PostScript files. A flaw lets an anonymous attacker from the internet run their own commands on a computer that processes a crafted file.

Official source
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1AttackerAnonymous remote attacker crafts a malicious file
  2. 2Malicious fileSent via upload, email or document link
  3. 3Ghostscript processes itFlaw is triggered during parsing or conversion
  4. 4Code runsAttacker commands execute on the system
  5. ResultAttacker gains code execution on the server

What happened

Multiple vulnerabilities in Ghostscript allow remote, unauthenticated attackers to execute arbitrary code, manipulate data, and in one case disclose or manipulate files or cause denial of service.

Why it is dangerous: Successful exploitation could give an attacker control over the system processing the file, or cause data loss or service outages. Any service that converts or previews untrusted documents with Ghostscript is at risk.

Are you affected?

You are affected if you run Ghostscript and it processes files or input from untrusted sources, such as web uploads, email attachments or document converters.

Ghostscript (exact affected versions not stated in the provided material)

What to do

  1. Check which Ghostscript version you run and whether it is listed as affected in the official BSI advisory
  2. Update Ghostscript to the fixed version from your vendor or the Ghostscript project as soon as it is available
  3. Until patched, avoid processing untrusted PDF or PostScript files with Ghostscript

Timeline

  1. 26 Oct 2026, 07:55 UTC
    Publicly disclosed
  2. 26 Oct 2026, 07:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 26 Oct 2026, 07:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  4. 26 Oct 2026, 07:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  5. 26 Oct 2026, 08:02 UTC
    Picked up by Zero Radar

Sources 3 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-9e74b658 · ZR-10e18520 · ZR-cbf2c065
Disclosed
26 Oct 2026, 07:55 UTC
On Zero Radar
26 Oct 2026, 08:02 UTC (7 min after disclosure)
Last change
26 Oct 2026, 11:49 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Ghostscript: remote attackers can run code and tamper with data · Zero Radar