Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 146

Export CSV
CVE-2026-125396

Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery

Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Artifex Artifex Software Inc.
Products
Ghostpdl Ghostscript Ghostscript
CVE-2020-27792

Ghostscript: heap buffer over write vulnerability in ghostscript's lp8000_print_page() in gdevlp8k.c

A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Artifex Debian Redhat
Products
Ghostscript Debian Linux Enterprise Linux and 1 more
CVE-2023-38559

Ghostscript: out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in dos

A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 1 more
Products
Ghostscript Debian Linux Fedora and 2 more
CVE-2023-38560

Ghostscript: integer overflow in pcl/pl/plfont.c:418 in pl_glyph_name

An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Artifex Redhat
Products
Ghostscript Enterprise Linux Rhel Els
CVE-2023-46751

ghostscript: dangling pointer in gdev_prn_open_printer_seekable()

An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Artifex Redhat
Products
Ghostscript Enterprise Linux
CVE-2026-103226

Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2021-45949

ghostscript: heap-based buffer overflow in sampled_data_finish

Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).

CVSS 3.1 · 3.9 Low EPSS 1.7% KEV · Not listed
Vendors
Artifex Debian
Products
Ghostscript Debian Linux
CVE-2026-39919

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2026-19547

Local Privilege Escalation in Ghostscript for Windows

Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows installations, combined with Windows default ACLs allowing any authenticated user to create directories at the root of C:\\, an attacker who is an authenticated local user can create the expected directory structure and plant a malicious PostScript file. When any user or service subsequently runs Ghostscript, the planted file is automatically loaded and executed with the full privileges of the Ghostscript process. This results in full compromise of Ghostscript process context, as well as running arbitrary code on the machine with Ghostscript process privileges. This issue was fixed in version 10.08.0.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Artifex Artifex Software Inc.
Products
Ghostscript Ghostscript
CVE-2023-36664

ghostscript: vulnerable to OS command injection due to mishandles permission validation for pipe devices

Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).

CVSS 3.1 · 7.8 High EPSS 3.9% KEV · Not listed
Vendors
Artifex Debian Fedoraproject and 1 more
Products
Ghostscript Debian Linux Fedora and 2 more
CVE-2025-27837

Ghostscript: Access to arbitrary files through truncated path with invalid UTF-8

An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2017-8291

ghostscript: corruption of operand stack

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

CVSS 3.1 · 7.8 High EPSS 97.0% KEV · Listed
Vendors
Artifex Debian Redhat
Products
Ghostscript Debian Linux Enterprise Linux and 6 more
CVE-2024-46956

ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Artifex Debian Redhat and 1 more
Products
Ghostscript Debian Linux Enterprise Linux and 3 more
CVE-2024-46953

ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript

An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Artifex Debian Redhat and 1 more
Products
Ghostscript Debian Linux Enterprise Linux and 3 more
CVE-2024-46951

ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space

An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Artifex Debian Redhat and 1 more
Products
Ghostscript Debian Linux Enterprise Linux and 3 more
CVE-2025-27836

Ghostscript: device: Print buffer overflow

An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2025-27835

Ghostscript: Buffer overflow when converting glyphs to unicode

An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2025-27832

Ghostscript: NPDL device: Compression buffer overflow

An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Artifex Redhat
Products
Ghostscript Enterprise Linux