CVE-2024-29506

Artifex Ghostscript is affected by CVE-2024-29506: Ghostscript before 10.03.0 contains a stack-based buffer overflow in pdfi_apply_filter() triggered by a long PDF filter name. Impact, per available references, includes potential memory corruption with high-severity risk; exploitation details are...

CVE-2025-27836

Artifex Ghostscript versions prior to 10.05.0 are vulnerable to a Print buffer overflow in the BJ10V device, specifically located in contrib/japanese/gdev10v.c . This issue allows for potential exploitation via network vectors with low complexity and no required privileges, potentially leading to...

CVE-2025-27831

Artifex Ghostscript versions prior to 10.05.0 are vulnerable to a text buffer overflow in the DOCXWRITE and TXTWRITE devices. The flaw exists in devices/vector/doc_common.c and can be triggered by providing long characters . This vulnerability has been identified in various distributions, includi...

CVE-2025-48708

The CVE-2025-48708 entry is confirmed to affect Artifex Ghostscript and is not a placeholder. The issue is in gs_lib_ctx_stash_sanitized_arg (base/gslibctx.c) before 10.05.1, where argument sanitization for the # case is missing, allowing a created PDF to include its password in cleartext. Affect...

CVE-2017-9835

The CVE-2017-9835 entry refers to Ghostscript 9.21, where the gs_alloc_ref_array path in psi/ialloc.c can be abused via crafted PostScript due to a missing integer overflow check in base/gsalloc.c, causing a heap-based buffer overflow and application crash (remote/denial of service). The connecte...

CVE-2016-10317

CVE-2016-10317 affects Ghostscript (noted in the Initial and connected docs). The issue is in fill_threshhold_buffer() in base/gxht_thresh.c of Ghostscript 9.20, allowing remote attackers to cause a heap-based buffer overflow and application crash via a crafted PostScript document (denial of serv...

CVE-2018-16585

Artifex Ghostscript prior to 9.24 is affected by CVE-2018-16585 where the .setdistillerkeys PostScript command is accepted despite not being intended for document processing. This leads to memory corruption, enabling remote attackers able to supply crafted PostScript to crash the interpreter or p...

CVE-2025-27837

A vulnerability exists in Artifex Ghostscript versions prior to 10.05.0 due to an incorrect path name limitation in the gp_open_scratch_file_impl() function. Specifically, the issue involves the base/gp_mswin.c and base/winrtsup.cpp files, where a truncated path containing invalid UTF-8 character...

CVE-2020-21710

CVE-2020-21710 is a divide-by-zero in Ghostscript 9.50’s eps_print_page (gdevepsn.c) that enables a remote attacker to cause a denial of service by opening a crafted PDF. The vulnerability is acknowledged and mitigated in vendor advisories: Red Hat RHSA-2024:2966, AlmaLinux ALSA-2024:2966, and ot...

CVE-2025-27833

Artifex Ghostscript versions prior to 10.05.0 are vulnerable to a buffer overflow (CWE-120) occurring when processing a long TTF font name in the pdf/pdf_fmap.c file. This flaw is related to a numerical overflow condition and can be exploited to cause a service failure . For users of the GPL Ghos...

CVE-2024-46952

CVE-2024-46952 affects Artifex Ghostscript before 10.04.0. The issue is a buffer overflow in the PDF processing path, specifically in pdf/pdf_xref.c during handling of a PDF XRef stream (related to W array values). The vulnerability is triggered when processing certain PDF cross-reference streams...

CVE-2016-10219

CVE-2016-10219 is tied to Ghostscript 9.20, where the intersect function in base/gxfill.c can be triggered by a crafted PostScript/PDF document to cause a remote denial of service and application crash via a divide-by-zero error. The linked connected documents corroborate the issue in Ghostscript...

CVE-2018-16513

CVE-2018-16513 affects Artifex Ghostscript prior to 9.24. A crafted PostScript file can trigger a type confusion in the setcolor function, potentially crashing the Ghostscript interpreter or causing unspecified other impact. Mitigation documented across multiple sources is to upgrade Ghostscript ...

CVE-2024-46954

Ghostscript before 10.05.0 is affected by decode_utf8() in base/gp_utf8.c mishandling of overlong UTF-8 encoding, enabling a potential directory traversal (CVE-2024-46954). Connected advisories corroborate the issue exists across multiple Linux distributions and note the fix requires upgrading Gh...

CVE-2017-9611

CVE-2017-9611 – Ghostscript GhostXPS 9.21 is affected. The vulnerability is in the Ins_MIRP function of base/ttinterp.c within Artifex Ghostscript GhostXPS 9.21, which allows remote attackers to cause a denial of service via a crafted document. The impact described is a heap-based buffer over-rea...

CVE-2024-29509

CVE-2024-29509 affects Artifex Ghostscript before 10.03.0, where a heap-based overflow occurs when PDFPassword (e.g., for runpdf) contains a embedded NUL byte in the middle. This can lead to corruption or potential code execution as described in public disclosures. The vulnerability is attributed...

CVE-2017-11714

CVE-2017-11714 is a vulnerability in Artifex Ghostscript 9.21 where psi/ztoken.c mishandles references to the scanner state structure, allowing a remote attacker to trigger a denial of service (application crash) or potentially other impact via a crafted PostScript document. The root cause involv...

CVE-2024-29507

Artifex Ghostscript versions prior to 10.03.0 are susceptible to a stack-based buffer overflow triggered via the CIDFSubstPath and CIDFSubstFont parameters. This vulnerability allows an attacker to potentially cause memory corruption or gain unauthorized access to protected information. Exploitat...

CVE-2016-10220

CVE-2016-10220 affects Artifex Ghostscript, specifically Ghostscript 9.20. The vulnerability is in the function gs_makewordimagedevice (base/gsdevmem.c) and can be triggered by a crafted PDF in the PDF Transparency module, leading to a NULL pointer dereference and an application crash (denial of ...

CVE-2016-8602

The CVE-2016-8602 issue affects Ghostscript before 9.21, where the .sethalftone5 function (psi/zht2.c) can be triggered by a crafted PostScript document with an empty operand stack. This could lead to a denial of service (application crash) and, in the worst case, arbitrary code execution. Affect...

CVE-2016-7977

Ghostscript before 9.21 could bypass SAFER mode using the .libfile operator in crafted PostScript, allowing reading arbitrary files. This CVE (CVE-2016-7977) affects Ghostscript up to version 9.20/9.21; remediation is to upgrade to Ghostscript 9.21 or newer where fixed. Related entries note simil...

CVE-2024-46955

CVE-2024-46955 : Ghostscript contains an out-of-bounds read in psi/zcolor.c when reading color in Indexed color space, before version 10.04.0. Impact is a local issue with user interaction required (per CVSS details: AV:L, UI:R, Availability:A:H). The fix is indicated by the ghostpdl-10.04.0 comm...

CVE-2020-36773

Summary: CVE-2020-36773 affects Artifex Ghostscript up to version 9.52.x (before 9.53.0). The flaw is an out-of-bounds write and use‑after‑free in devices/vector/gdevtxtw.c (txtwrite) caused by a single PDF character code mapping to multiple Unicode code points (e.g., ligatures). Impact (per sour...

CVE-2016-7979

Ghostscript before 9.21 vulnerable to bypassing SAFER mode protection and executing arbitrary code via type confusion in .initialize_dsc_parser. This CVE (CVE-2016-7979) affects Ghostscript up to version prior to 9.21; exploitation would occur through crafted PostScript documents that trigger typ...

CVE-2025-27834

Artifex Ghostscript versions prior to 10.05.0 are vulnerable to a buffer overflow in the pdf/pdf_func.c component. The root cause is an unsigned int overflow triggered by an oversized Type 4 function definition within a PDF document, which causes the allocated buffer to be smaller than required. ...

CVE-2017-8908

CVE-2017-8908 is a Ghostscript vulnerability (affecting Ghostscript 9.21) where the mark_line_tr function in gxscanc.c can be triggered by a crafted PostScript document to cause an out-of-bounds read and denial of service. Public references in connected docs corroborate the issue as a Ghostscript...

CVE-2016-10218

CVE-2016-10218 is a vulnerability in Artifex Ghostscript (Ghostscript 9.20) where the pdf14_pop_transparency_group function (base/gdevp14.c, PDF Transparency module) can be triggered by a crafted file to cause a NULL pointer dereference and application crash, i.e., a denial of service. This is tr...

CVE-2017-15652

CVE-2017-15652 affects Artifex Ghostscript 9.22. The vulnerability is described as an information disclosure risk: attackers can obtain sensitive information through processing a PostScript file. The affected area includes source code files, functions, executables, and libga usage (imagemagick re...

CVE-2017-7948

CVE-2017-7948 describes an integer overflow in Ghostscript 9.21’s mark_curve function, enabling a crafted PostScript document to trigger an out-of-bounds write and crash the application (denial of service) or potentially other impacts. Public advisories and OpenVAS/Gentoo entries confirm Ghostscr...