Ubuntu patches Ghostscript sandbox escapes, arbitrary code execution flaws

Ubuntu released security updates for Ghostscript across all supported releases from 16.04 LTS through 26.10. Two flaws involve incorrect memory handling during PostScript processing and font conversion, while a third stems from improper operand validation when loading fonts. All three can lead to sandbox bypass and arbitrary code execution. Fixes are available through standard updates for current releases; older LTS releases require Ubuntu Pro.

Vulnerabilities and affected versions

• CVE-2026-101258: Memory handling flaw in PostScript document processing; reported by Rick de Jager
• CVE-2026-103226: Memory handling flaw during font conversion; allows crash or arbitrary code execution
• Third flaw (no CVE): Improper operand validation when loading fonts; reported by Paulos Yibelo; enables sandbox bypass
• Affected packages: libgs10 on 24.04–26.10, libgs9 on 16.04–22.04
• 16.04/18.04/20.04 fixes require Ubuntu Pro or Legacy Support add-on

Why it matters

Ghostscript is widely used for PDF and PostScript rendering in Linux printing pipelines, document viewers, and server-side conversion tools. Sandbox bypass vulnerabilities are particularly severe for automated document processing services.