Ghostscript Windows LPE via file hijacking patched

Published29 September 2026 Vorant ratingroutine vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Ghostscript for Windows before 10.08.0 lets local users hijack predictable PostScript resource paths under C:\gs\ to escalate privileges.

Sourcecert.pl — open the original

What to check

Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska coordinated disclosure of CVE-2026-19547, a local privilege escalation vulnerability in Ghostscript for Windows. The flaw stems from Ghostscript searching for PostScript resource files in predictable, non-default paths under C:\gs\. Because Windows' default ACLs allow any authenticated local user to create directories at the root of C:\, an attacker can pre-create the expected directory structure and plant a malicious PostScript file before Ghostscript is ever run legitimately.

When any user or service subsequently invokes Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process — resulting in arbitrary code execution and full compromise of that process context. This is a classic file/path hijacking privilege escalation issue rather than a remote exploitation vector; it requires local authenticated access to the target machine. The vulnerability was reported by Julian Horoszkiewicz of Atos Threat Research Center and fixed in Ghostscript version 10.08.0.

Defenders running Ghostscript on Windows, particularly in shared or multi-user environments, in print servers, or in any automated pipeline invoking Ghostscript with elevated privileges, should upgrade to 10.08.0 or later. As mitigation prior to patching, restrict write access to the root of C:\ and audit for unexpected directories/files under C:\gs\.

Mentioned in this report

Vulnerabilities CVE-2026-19547

Detection guidance

Ghostscript Invocation with Suspicious Resource Path

ATT&CK T1574.001 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects Ghostscript process execution (gswin32c.exe, gswin64c.exe) originating from non-standard parent processes or with command-line flags that may trigger resource loading from attacker-controlled directories. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Ghostscript Invocation with Suspicious Resource Path
description: Detects Ghostscript processes spawned by non-typical parents (user shells,
  remote execution tools) that may load hijacked PostScript resources from C:\gs\.
  Targets the distinctive Ghostscript binary names and execution context anomalies.
tags:
- attack.privilege-escalation
- attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_ghostscript:
    Image|endswith:
    - \gswin32c.exe
    - \gswin64c.exe
    - \gswin32.exe
    - \gswin64.exe
  selection_suspicious_parent:
    ParentImage|endswith:
    - \cmd.exe
    - \powershell.exe
    - \wmic.exe
    - \rundll32.exe
    - \cscript.exe
  filter_print_service:
    ParentImage|endswith:
    - \spoolsv.exe
    - \svchost.exe
  condition: selection_ghostscript and selection_suspicious_parent and not filter_print_service
falsepositives:
- System administrators manually invoking Ghostscript from command-line for testing
- Legitimate automation scripts launching Ghostscript from batch/PowerShell
level: medium
id: 9efb1e93-edf5-5998-a3c7-291ce275fad9
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/09/CVE-2026-19547

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/09/CVE-2026-19547

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs