A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-112177 represents a critical regression in Ghostscript's security posture affecting Red Hat Enterprise Linux 8 systems. During a version rebase from 9.25 to 9.27, the security fix for CVE-2019-14869 was inadvertently omitted, leaving the .charkeys procedure's .forceput operations inadequately protected. This allows attackers to bypass the -dSAFER sandbox restrictions—a fundamental security boundary in Ghostscript—enabling unauthorized file access beyond permitted paths and arbitrary command execution with the privileges of the Ghostscript process. Organizations relying on Ghostscript for document processing, particularly in automated workflows handling untrusted PostScript files, face significant risk of privilege escalation and data exfiltration.
While this CVE does not map directly to MITRE ATT&CK techniques in its current form, Casky's 754 security skills powered by Claude AI would identify the attack patterns through behavioral analysis of PostScript processing anomalies. Practitioners using Casky would observe detection signals related to privilege boundary violations, suspicious file descriptor access attempts, and process execution deviations during PostScript interpretation. The platform's extended reasoning capabilities would correlate incomplete patch application patterns with known sandbox escape methodologies, flagging the specific .forceput operation abuse as indicative of CVE-2026-112177 exploitation attempts. This enables security teams to detect and respond to attacks before malicious PostScript documents can compromise system integrity.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-112177. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation