openSUSE Tumbleweed Ships Ghostscript Update Closing Two Document Processing Flaws
openSUSE has published advisory openSUSE-SU-2026:12128-1, a moderate-rated update that delivers ghostscript 10.08.0-2.1 on the GA media of openSUSE Tumbleweed. The release resolves two vulnerabilities tracked as CVE-2026-101258 and CVE-2026-103226, both affecting the Ghostscript PostScript and PDF interpreter that underpins printing and document conversion on many Linux systems. CVE-2026-101258 carries a SUSE-assigned CVSS v3.1 score of 7.8 and requires local access with user interaction. CVE-2026-103226 is scored 8.1 under CVSS v3.1 and 9.2 under CVSS v4.0, and is reachable over the network without privileges or user interaction. The affected package set covers ghostscript, ghostscript-devel and ghostscript-x11.
The advisory does not publish exploitation details, proof-of-concept code or a technical breakdown of either flaw, so the underlying mechanism has not been disclosed by the vendor. What the scoring vectors do convey is the exposure profile of each issue. CVE-2026-101258 needs a local vector and a user to open or process something, which fits the familiar pattern of a malicious document being handed to an interpreter. CVE-2026-103226 is remote and unauthenticated but rated high attack complexity, and both flaws are marked as fully impacting confidentiality, integrity and availability.
Ghostscript sits quietly in the middle of a great deal of automated document handling, including print queues, PDF thumbnailing and server-side file conversion, which means affected code is often invoked on untrusted input without a human in the loop. Tumbleweed is a rolling release, so systems that have not taken a recent snapshot continue running the older package. Current exploitation activity is low: FIRST EPSS puts CVE-2026-101258 at a 0.2 percent probability of exploitation in the next 30 days and CVE-2026-103226 at 0.3 percent.
Attack Surface
Endpoint OS, Server OS
Tactics
Execution, Initial Access
Techniques
- T1203 – Exploitation for Client Execution
- T1190 – Exploit Public-Facing Application
- T1204.002 – User Execution: Malicious File
SuperPRO's Threat Countermeasures Procedures
- Install ghostscript 10.08.0-2.1 from the openSUSE Tumbleweed GA media, which carries the fixes for CVE-2026-101258 and CVE-2026-103226 per advisory openSUSE-SU-2026:12128-1.
- Update the companion packages shipped in the same advisory, ghostscript-devel 10.08.0-2.1 and ghostscript-x11 10.08.0-2.1, since partial updates leave vulnerable interpreter code on the host.
- Inventory Tumbleweed hosts with 'rpm -q ghostscript ghostscript-devel ghostscript-x11' and flag any system reporting a version below 10.08.0-2.1 for scheduled remediation.
- Refresh repositories and apply the update with 'zypper refresh && zypper dup' on rolling-release Tumbleweed systems, as snapshot-based machines that have not synced recently retain the older package.
- Prioritise servers where Ghostscript is invoked automatically on untrusted input, such as CUPS print filters, ImageMagick delegate conversions and PDF thumbnailing services, because CVE-2026-103226 is scored as network reachable without authentication.
- Restrict Ghostscript file and network operations on unpatched hosts by running conversion workers under a dedicated unprivileged account with systemd confinement options such as PrivateTmp and ProtectSystem=strict.
- Alert in EDR or auditd on gs or gsx processes spawning shells or writing outside their working directory, a behaviour consistent with successful interpreter abuse.
