{"id":"CVE-2026-19547","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-19547","generatedAt":"2026-10-28T03:30:35.976Z","title":"Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking.","description":"Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\\\gs\\\\ that do not exist by default on Windows installations, combined with Windows default ACLs allowing any authenticated user to create directories at the root of C:\\\\, an attacker who is an authenticated local user can create the expected directory structure and plant a malicious PostScript file. When any user or service subsequently runs Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process. This results in full compromise of Ghostscript process context, as well as running arbitrary code on the machine with Ghostscript process privileges.\n\n\nThis issue was fixed in version 10.08.0.","published":"2026-09-29T10:17:11.000Z","lastModified":"2026-09-30T19:38:27.000Z","status":"Awaiting Analysis","sourceIdentifier":"cvd@cert.pl","cvss":{"version":"4.0","score":7,"severity":"HIGH","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-426"],"affected":[],"epss":{"score":0.00113,"percentile":0.01414,"date":"2026-10-26","history":[{"date":"2026-09-30","score":0.00159,"percentile":0.04395}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.11%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-29T10:17:11.000Z","detail":{"score":"7.0","severity":"HIGH","publishedAt":"2026-09-29T10:17:11.410Z"},"summary":"New CVE, high severity (CVSS 7.0)."}],"references":[{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709522","source":"cvd@cert.pl"},{"url":"https://cert.pl/en/posts/2026/09/CVE-2026-19547","source":"cvd@cert.pl"},{"url":"https://ghostscript.com/","source":"cvd@cert.pl"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-19547","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}