Medium severity · published Sep 5, 2018
CVE-2018-16541
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter
5.5
CVSS
1.4%
EPSS
No
On KEV
Description
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.6 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
7.6 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
7.6 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
GH
Ghostscript · Artifex
before 9.24 · source: NVD
UL
Ubuntu Linux · Canonical
14.04; 16.04; 18.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16541
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16541
git.ghostscript.com
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=241d91112771a6104de10b3948c3f350d6690c1d
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3834
Issue Tracking
https://bugs.ghostscript.com/show_bug.cgi?id=699664
Mailing List
https://lists.debian.org/debian-lts-announce/2018/09/msg00015.html
Third Party Advisory
https://security.gentoo.org/glsa/201811-12
Third Party Advisory
https://usn.ubuntu.com/3768-1/
More from Ghostscript
7.8
CVE-2017-8291
Artifex Ghostscript Type Confusion Vulnerability
9.9
CVE-2021-3781
A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command
9.8
CVE-2025-27837
An issue was discovered in Artifex Ghostscript before 10.05.0
9.8
CVE-2025-27836
An issue was discovered in Artifex Ghostscript before 10.05.0
9.8
CVE-2025-27832
An issue was discovered in Artifex Ghostscript before 10.05.0