CVE-2026-103226
Canonical Ubuntu Linux: memory corruption
- Risk score
- 52/100
- CVSS
- 6.3 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might…
- Affected
- Canonical Ubuntu Linux
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Amber, patch this week. U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.
The flaws
- CVE-2026-103226: Memory corruption (CVSS 6.3 · EPSS 1%)
- CVE-2026-74221: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-74220: Denial of service (CVSS 8.2 · EPSS 0%)
- CVE-2026-103262: Denial of service (CVSS 7.5 · EPSS 1%)
The fix
Upgrade Canonical Ubuntu Linux: 2026.10 · 6.5.9 or later on your release line
Who is exposed: Canonical Ubuntu Linux before 2026.10
Where it stands
- No known exploitation
How it unfolded
- 21 Oct, Ubuntu security notices (official): USN-8949-1: Ghostscript vulnerabilities
- 21 Oct, Ubuntu security notices (official): USN-8930-2: U-Boot vulnerabilities
- 22 Oct, Ubuntu security notices (official): USN-8952-1: Tornado vulnerabilities
Connects to
- Same weakness: Memory corruption (CWE-119). 272 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 15 in the last 90 days
Why it is Yellow
- CVSS 6.3 medium
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-8949-1
- https://artifex.com/
- https://bugs.ghostscript.com/attachment.cgi?id=28495
- https://bugs.ghostscript.com/show_bug.cgi?id=709672
- https://bugs.ghostscript.com/show_bug.cgi?id=709672#c3
- https://ghostscript.com/releases/gsdnld.html
- https://vuldb.com/cve/CVE-2026-103226
- https://vuldb.com/submit/955016
- https://vuldb.com/vuln/411906
- https://vuldb.com/vuln/411906/cti
Original description
A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."
Last activity 21 Oct 2026. Patch Forecast updates every hour.