CVE-2020-16297

CVE-2020-16297 describes a buffer overflow in Ghostscript: FloydSteinbergDitheringC() in contrib/gdevbjca.c affects Ghostscript 9.18–9.50 and can allow a remote attacker to cause a denial of service via a crafted PDF file. The issue is fixed in Ghostscript v9.51. Affected products and exact compo...

CVE-2018-15911

CVE-2018-15911 affects Artifex Ghostscript 9.23 prior to 2018-08-24. Attackers able to supply crafted PostScript can trigger uninitialized memory access in the aesdecode operator, potentially crashing the interpreter or executing code. Exploitation status is not detailed in the provided documents...

CVE-2018-17961

CVE-2018-17961 affects Artifex Ghostscript 9.25 and earlier. It enables sandbox bypass via vectors involving errorhandler setup, saved execution stacks, or the 1Policy operator, potentially allowing code execution or sandbox escape when processing crafted PostScript. The issue is related to an in...

CVE-2020-16304

Ghostscript (Artifex) v9.18–v9.50 contains a buffer overflow in image_render_color_thresh() in base/gxicolor.c that could allow a remote attacker to escalate privileges via a crafted EPS file. The issue is addressed in v9.51. Connected sources corroborate the vulnerability in Ghostscript and refe...

CVE-2018-18073

CVE-2018-18073 describes a sandbox-bypass vulnerability in Artifex Ghostscript. The issue arises in Ghostscript 9.25 and earlier where the saved execution stack can leak operator arrays or expose system operators in an error object, allowing a crafted PostScript to bypass -dSAFER/sandbox protecti...

CVE-2020-16291

Ghostscript vulnerability CVE-2020-16291 is a buffer overflow in contrib/gdevdj9.c affecting Ghostscript versions 9.18 through 9.50, which can cause a denial of service when processing a crafted PDF. The issue is fixed in Ghostscript 9.51. Affected users should upgrade to >= 9.51 to mitigate t...

CVE-2020-16307

Ghostscript (Artifex) vulnerable in version 9.50 due to a null pointer dereference in devices/vector/gdevtxtw.c and psi/zbfont.c, which could allow a remote attacker to cause a denial of service via a crafted PostScript file. The issue is mitigated by upgrading to version 9.51 (as reported by CVE...

CVE-2018-18284

Ghostscript 9.25 and earlier is affected by CVE-2018-18284, where the sandbox protection can be bypassed via vectors involving the 1Policy operator. Affected component: Ghostscript interpreter; root cause: sandbox bypass in policy handling. Impact: sandbox escape via crafted PostScript; in the Ar...

CVE-2020-16287

Ghostscript v9.50 is affected by a buffer overflow in lprn_is_black() (contrib/lips4/gdevlprn.c) that could allow a remote attacker to cause a denial of service via a crafted PDF. The issue is fixed in Ghostscript v9.51. Suggested action: upgrade to 9.51 or later. CVSS data present in the provide...

CVE-2018-15909

CVE-2018-15909 affects Artifex Ghostscript 9.23 (pre-2018-08-24). A type confusion in the .shfill PostScript operator can be triggered by specially crafted PostScript data, allowing an attacker to crash the Ghostscript interpreter or potentially execute arbitrary code. The vulnerability is docume...

CVE-2020-14373

CVE-2020-14373 involves a use-after-free in igc_reloc_struct_ptr() (psi/igc.c) of Ghostscript, reported in version 9.25. A local attacker could craft a PDF to trigger a denial of service. The available documents confirm the root cause location and impact (DoS) but do not provide published exploit...

CVE-2020-16303

CVE-2020-16303 : A use-after-free in xps_finish_image_path() (devices/vector/gdevxps.c) of Artifex Software GhostScript v9.50 can let a remote attacker escalate privileges via a crafted PDF. The issue is fixed in Ghostscript v9.51. Affected product: Ghostscript (Artifex). Remediation: upgrade to ...

CVE-2020-17538

Ghostscript vulnerability CVE-2020-17538: a buffer overflow in GetNumSameData() within contrib/lips4/gdevlips.c affects Ghostscript versions 9.18–9.50 and can cause a denial of service when processing crafted PDFs. The issue is fixed in v9.51; affected users should upgrade to Ghostscript 9.51 or ...

CVE-2020-16309

CVE-2020-16309 : Ghostscript v9.50 contains a buffer overflow in lxm5700m_print_page() (devices/gdevlxm.c) that can be exploited remotely via a crafted EPS file to cause a DoS. Root cause: bounds-check failure in that printer/page rendering path. A fix is available in Ghostscript v9.51; upgrade t...

CVE-2018-16802

Artifex Ghostscript prior to 9.25 is affected by CVE-2018-16802: incorrect “restoration of privilege” checking when stack overflows during exception handling could allow code execution via crafted PostScript using the pipe operator. This stems from an incomplete fix for CVE-2018-16509. The issue ...

CVE-2020-27792

CVE-2020-27792 is a heap-based buffer overflow in Ghostscript affecting the lp8000_print_page() path (gdevlp8k.c). The flaw can be triggered by a crafted PDF, potentially causing memory corruption or a denial of service. The vulnerability is cited across multiple advisories (Ghostscript/GhostPDL)...

CVE-2016-7978

GBGhostscript CVE-2016-7978 is a use-after-free caused by a reference leak in .setdevice, enabling remote code execution. The IBM PowerKVM bulletin confirms Ghostscript-related fixes and states PowerKVM 2.1/3.1 are affected, with remediation via updates: PowerKVM 3.1.0.2 update 5 or later (and 2....

CVE-2019-25059

CVE-2019-25059 affects Artifex Ghostscript (through 9.26) with a mishandling of .completefont, noted as stemming from an incomplete fix for CVE-2019-3839. Connected advisories/tracker data indicate a remediation via Ghostscript package updates (e.g., Debian’s 9.26+ and vendor advisories urging up...

CVE-2020-16308

CVE-2020-16308 affects Artifex Software Ghostscript v9.50, with a vulnerability in p_print_image() in devices/gdevcdj.c that could allow a remote attacker to cause a denial-of-service via a crafted PDF file. The issue is mitigated by upgrading to Ghostscript v9.51, which contains the fix. Referen...

CVE-2020-16295

Ghostscript v9.50 contains a null pointer dereference in clj_media_size() (devices/gdevclj.c) that allows remote attackers to cause a denial of service via crafted PDF files. The issue affects Artifex Ghostscript 9.50 and is fixed in version 9.51. Mitigation: upgrade to 9.51 or newer. The CVE is ...

CVE-2020-16289

CVE-2020-16289 describes a buffer overflow in Ghostscript 9.50, specifically in cif_print_page() within devices/gdevcif.c, which could allow a remote attacker to cause a denial of service by processing a crafted PDF. The issue is fixed in Ghostscript 9.51. Affected product: Artifex Software Ghost...

CVE-2020-16296

Ghostscript (Artifex) vulnerable in GetNumWrongData() within contrib/lips4/gdevlips.c across versions 9.18–9.50; exploitable by processing a crafted PDF file, resulting in denial of service. The issue is confirmed fixed in v9.51. Affected releases and fixes are corroborated across multiple source...

CVE-2020-16302

Ghostscript 9.50 contains a buffer overflow in jetp3852_print_page() (devices/gdev3852.c) that could let a remote attacker escalate privileges via a crafted PDF. The issue is fixed in Ghostscript 9.51. Connected sources (CVE-2020-16302) corroborate the flaw and its remediation across distribution...

CVE-2020-16294

The CVE-2020-16294 vulnerability is a buffer overflow in Ghostscript v9.50 affecting epsc_print_page() in devices/gdevepsc.c, exploitable via a crafted PDF to cause a denial of service. The issue is fixed in Ghostscript v9.51; remediation is to upgrade to at least 9.51. The connected sources (e.g...

CVE-2018-16543

CVE-2018-16543 affects Ghostscript. In versions prior to 9.24, the functions gssetresolution and gsgetresolution could be exploited to cause an unspecified impact. Public advisories in the connected set (EulerOS, openSUSE/SUSE/SUSE-like updates) confirm the issue and show a remediation path: upgr...

CVE-2016-7976

CVE-2016-7976 concerns Ghostscript’s PS Interpreter. The initial document states that Ghostscript versions 9.18 and 9.20 are affected, and that a remote attacker can execute arbitrary code via crafted userparams. Connected sources reiterate the same CVE across multiple advisories and Nessus plugi...

CVE-2020-16306

Ghostscript v9.50 is affected by a NULL pointer dereference in devices/gdevtsep.c that allows remote denial-of-service via a crafted PostScript file. The issue is fixed in Ghostscript 9.51. Affected products and impact are described in CVE-2020-16306 entries across multiple advisories (e.g., Debi...

CVE-2020-16300

Ghostscript 9.50 contains a buffer overflow in tiff12_print_page() (devices/gdevtfnx.c) that can be triggered by a crafted PDF file, allowing a remote attacker to cause denial of service. The issue is fixed in Ghostscript 9.51. Affected product: Artifex Ghostscript. Root cause: a buffer overflow ...

CVE-2018-16511

Artifex Ghostscript (pre-9.24) is vulnerable to a type confusion in ztype that remote attackers can exploit via crafted PostScript to crash the interpreter (possible other impact). The CVE entry for CVE-2018-16511 is supported by multiple advisories; remediation is to update Ghostscript to a newe...

CVE-2020-16290

CVE-2020-16290 describes a buffer overflow in Artifex Ghostscript (Ghostscript v9.50) specifically in jetp3852_print_page() within devices/gdev3852.c. Exploitation could allow a remote attacker to cause a denial of service by processing a crafted PDF file. The vulnerability was fixed in Ghostscri...

CVE-2018-16541

Ghostscript before 9.24 is affected by CVE-2018-16541 due to incorrect free logic in pagedevice replacement when processing crafted PostScript files, which can crash the interpreter. Affected products in public advisories include Ghostscript packages across several distributions (e.g., CentOS 7, ...

CVE-2020-16288

Ghostscript (Artifex) CVE-2020-16288 affects the 9.50 release. The vulnerability is a buffer overflow in pj_common_print_page() within devices/gdevpjet.c, exploitable by processing a crafted PDF file and capable of causing a denial of service. The issue is fixed in Ghostscript 9.51 (upgrade recom...

CVE-2021-45944

CVE-2021-45944 affects Ghostscript GhostPDL versions 9.50–9.53.3, with a use-after-free in sampled_data_sample (called from sampled_data_continue and interp). The vulnerability is described in the connected Astra/NVD entries for Ghostscript; the root cause is a use-after-free in the sampled_data_...

CVE-2025-27832

The CVE-2025-27832 issue affects Ghostscript prior to 10.05.0, specifically the NPDL device’s Compression buffer in contrib/japanese/gdevnpdl.c, which leads to a buffer/integer overflow. Public reports from multiple sources (e.g., ALAS/Amazon Linux advisories and Astra Linux bulletin) confirm the...

CVE-2020-16292

Ghostscript v9.50 contains a buffer overflow in mj_raster_cmd() (contrib/japanese/gdevmjc.c) that can be triggered by processing a crafted PDF, allowing a remote attacker to cause a denial of service. The issue is fixed in Ghostscript v9.51. Affected product: Artifex Ghostscript; vulnerable compo...

CVE-2020-16299

Ghostscript vulnerability CVE-2020-16299: A Division by Zero in bj10v_print_page() (contrib/japanese/gdev10v.c) of Artifex Ghostscript v9.50 can cause a denial of service via a crafted PDF. Affects Ghostscript 9.50; fixed in v9.51. Remediation is to upgrade to 9.51 or later. No exploit details ar...

CVE-2018-16542

CVE-2018-16542 affects Artifex Ghostscript prior to 9.24. An attacker could craft PostScript to trigger insufficient interpreter stack-size checking during error handling, potentially crashing the Ghostscript interpreter (denial of service). Some connected sources also describe a stack-based out-...

CVE-2020-21890

CVE-2020-21890 is a buffer overflow in Ghostscript 9.50 (function clj_media_size in devices/gdevclj.c) that can be triggered by opening crafted PDFs, leading to denial of service or other unspecified impact. Public references confirm Ghostscript versions around 9.50 are affected; remediation note...

CVE-2022-2085

CVE-2022-2085 is a NULL pointer dereference in Ghostscript triggered when rendering a large number of bits; for bpp > 64, mem_x_device is used and init_device_procs is missing, causing crashes. The issue affects various Ghostscript deployments (e.g., Artifex Ghostscript and GPL Ghostscript) an...

CVE-2016-10217

CVE-2016-10217 (Ghostscript 9.20): The pdf14_open function in base/gdevp14.c is vulnerable to a use-after-free via a crafted PostScript/PDF in the color management path, allowing remote denial of service (crash). The provided documents do not specify a vendor patch or remediation for this CVE. Mo...

CVE-2018-16510

CVE-2018-16510 refers to Ghostscript before 9.24, where an issue in the PDF primitives CS and SC incorrectly handled the exec stack. This could allow remote attackers to crash the interpreter or cause unspecified other impact by supplying crafted PDFs. The connected advisories confirm remediation...

CVE-2025-27835

CVE-2025-27835 affects Ghostscript prior to 10.05.0. The issue is a buffer overflow that occurs when converting glyphs to Unicode in the code path psi/zbfont.c, caused by a mismatch in how data is copied (bytes vs. shorts). The vulnerability concerns the Ghostscript PostScript/PDF interpreter and...

CVE-2017-5951

CVE-2017-5951 is a vulnerability in Artifex Ghostscript 9.20 where mem_get_bits_rectangle in base/gdevmem.c could cause a NULL pointer dereference and crash the application when processing a crafted file. This is a remote-denial-of-service/ crash scenario reported in the provided sources; no expl...

CVE-2021-45949

CVE-2021-45949 affects Ghostscript GhostPDL 9.50 through 9.54.0. The vulnerability is a heap-based buffer overflow in the function sampled_data_finish, which is called from sampled_data_continue and interp. This is the specific flaw described in the provided documents. The vulnerability is associ...

CVE-2018-16539

CVE-2018-16539 affects Artifex Ghostscript (prior to 9.24). A crafted PostScript file could bypass access checks in temp file handling, allowing disclosure of files on the system. Multiple advisories (Debian, Red Hat/CentOS, Gentoo, Fedora, IBM PowerKVM, Amazon Linux) document this vulnerability ...

CVE-2024-46956

CVE-2024-46956 affects Artifex Ghostscript (psi/zfile.c) with an out-of-bounds data access in filenameforall that can lead to arbitrary code execution on Ghostscript versions up to 10.04.0. Connected advisories confirm this vulnerability and provide patch guidance; mitigation is to update Ghostsc...

CVE-2024-46951

CVE-2024-46951 is an issue in Artifex Ghostscript (Pattern color space) where an unchecked Implementation pointer could lead to arbitrary code execution. Connected advisories confirm this affects Ghostscript’s PostScript/PDF interpreter and note a developer-identified fix in ghostpdl-10.04.0, add...

CVE-2025-46646

CVE-2025-46646 affects Artifex Ghostscript prior to 10.05.0, where decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encodings. This issue is linked to an incomplete fix for CVE-2024-46954. Affected products include Ghostscript releases before 10.05.0; multiple advisories reference upgrades...

CVE-2025-27830

Ghostscript vulnerability CVE-2025-27830: a buffer overflow occurs when serializing DollarBlend in fonts, tracked to base/write_t1.c and psi/zfapi.c, in affected Ghostscript releases prior to 10.05.0. Exploitation could lead to denial of service and potentially arbitrary code execution if malform...

CVE-2025-27831

Summary: CVE-2025-27831 affects Ghostscript prior to 10.05.0, with a text buffer/Unicode decoding overrun in the DOCXWRITE TXTWRITE device (vector/doc_common.c). The vulnerability is confirmed by multiple connected sources (e.g., Debian security advisories and vendor advisories) referencing the s...