CVE-2026-19547: Ghostscript Windows Privilege Escalation

CVE-2026-19547 Overview

CVE-2026-19547 is a local privilege escalation vulnerability in Ghostscript for Windows. The flaw stems from Ghostscript searching for PostScript resource files in predictable paths under C:\gs\ that do not exist by default. Windows default Access Control Lists (ACLs) permit any authenticated user to create directories at the root of C:\. An authenticated local attacker can plant a malicious PostScript file in the expected directory. When another user or service later runs Ghostscript, the planted file loads and executes with the privileges of that Ghostscript process. Artifex fixed the issue in Ghostscript version 10.08.0.

Critical Impact
Any authenticated local user can execute arbitrary code in the security context of any user or service that subsequently invokes Ghostscript, enabling privilege escalation to higher-privileged accounts.

Affected Products

Ghostscript for Windows versions prior to 10.08.0
Windows systems where Ghostscript is invoked by higher-privileged users or services
Applications and print pipelines that embed or shell out to Ghostscript on Windows

Discovery Timeline

2026-09-29 - CVE-2026-19547 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-19547

Vulnerability Analysis

Ghostscript for Windows resolves PostScript resource files through a search path that includes locations under C:\gs\. These directories are not present in a default Windows installation. The application does not validate the trust boundary of the path before loading resources from it. Any PostScript file placed at the expected location is interpreted with the full authority of the Ghostscript process.

The issue is classified under CWE-426: Untrusted Search Path. Because PostScript is a Turing-complete language executed by the Ghostscript interpreter, code planted in the resource path runs immediately when the interpreter initializes. Exploitation requires user interaction in the form of another account invoking Ghostscript, but no privileged action by the attacker beyond writing to C:\.

Root Cause

Two conditions combine to create the vulnerability. First, Ghostscript hardcodes a Windows resource search path under C:\gs\ that does not exist on stock systems and is not owned by the installer. Second, the default Windows ACL on the root of the system drive grants the Authenticated Users group permission to create subdirectories. A standard user can therefore create the expected directory tree and populate it with attacker-controlled content that the interpreter treats as trusted.

Attack Vector

An authenticated local user creates the directory hierarchy under C:\gs\ that matches Ghostscript's expected resource layout. The attacker writes a malicious PostScript file into that location. When a different user, an administrator, or a service account runs Ghostscript—directly or through an application that invokes it—the interpreter loads the planted resource. The PostScript payload executes with the privileges of the invoking process, yielding code execution and lateral movement into higher-privileged contexts. Refer to the Ghostscript Bug Report #709522 and the CERT Poland advisory for additional technical detail.

Detection Methods for CVE-2026-19547

Indicators of Compromise

Presence of a C:\gs\ directory tree on hosts where Ghostscript was not installed under that path, particularly containing .ps or resource files
Unexpected child processes spawned by gswin32c.exe, gswin64c.exe, or applications that embed Ghostscript
Non-administrative accounts creating directories directly under C:\
PostScript files with system-level operators (file, run, shell) in user-writable locations

Detection Strategies

Monitor file creation events at C:\gs\* using Windows Security event ID 4663 or endpoint telemetry for FileCreate operations by non-installer processes
Alert on Ghostscript processes reading resource files from paths outside the official install directory
Baseline expected parent-child process trees for Ghostscript and flag deviations, especially cmd.exe, powershell.exe, or script hosts spawned by gs*.exe

Monitoring Recommendations

Enable Sysmon event IDs 1 (process creation) and 11 (file create) with rules targeting C:\gs\ and Ghostscript binaries
Audit ACLs on the root of every fixed drive and log write attempts by non-privileged principals
Correlate Ghostscript invocations across user contexts to identify cases where a low-privileged planted resource is loaded by a service or administrator

How to Mitigate CVE-2026-19547

Immediate Actions Required

Upgrade Ghostscript for Windows to version 10.08.0 or later on every affected host
Inventory all applications, print servers, and document conversion pipelines that bundle or invoke Ghostscript and patch each instance
Create C:\gs\ as an administrator-owned directory with restrictive ACLs to preempt planting on unpatched systems
Remove any existing unauthorized C:\gs\ directory and inspect its contents for planted PostScript files

Patch Information

The issue is fixed in Ghostscript 10.08.0. Obtain the update from the Ghostscript official website and validate the installed version after deployment. Track the upstream fix through Ghostscript Bug Report #709522.

Workarounds

Harden the root of C:\ by removing the CREATE_SUBDIRECTORY permission for Authenticated Users where operationally feasible
Pre-create C:\gs\ and all subdirectories referenced by Ghostscript's resource search with SYSTEM and Administrators full control, denying write access to standard users
Restrict Ghostscript execution to dedicated service accounts and prevent interactive invocation by high-privileged users
Configure application allowlisting to block execution of Ghostscript binaries from unexpected locations

bash

# Configuration example: pre-create and lock down C:\gs on Windows
icacls C:\ /remove:g "*S-1-5-11" 2>NUL
mkdir C:\gs
icacls C:\gs /inheritance:r
icacls C:\gs /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"