GH
Product
Ghostscript
On CISA KEVExploited in the wild
130
CVEs
1
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 12High 56Medium 60Low 2
Watch
Add Ghostscript to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-16513 | 7.8 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have… Affected: before 9.24 |
| CVE-2018-16511 | 7.8 | Sep 5 | An issue was discovered in Artifex Ghostscript before 9.24 Affected: before 9.24 |
| CVE-2018-16510 | 7.8 | Sep 5 | An issue was discovered in Artifex Ghostscript before 9.24 Affected: before 9.24 |
| CVE-2018-16509 | 7.8 | Sep 5 | An issue was discovered in Artifex Ghostscript before 9.24 Affected: before 9.24 |
| CVE-2018-15911 | 7.8 | Aug 28 | In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter… Affected: through 9.23 |
| CVE-2018-15910 | 7.8 | Aug 27 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or… Affected: before 9.24 |
| CVE-2018-15909 | 7.8 | Aug 27 | In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the… Affected: through 9.23 |
| CVE-2018-15908 | 7.8 | Aug 27 | In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files Affected: through 9.23 |
| CVE-2018-10194 | 7.8 | Apr 18 | The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning… Affected: through 9.22 |
| CVE-2017-11714 | 7.8 | Jul 28 | psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or… Affected: 9.21 |
| CVE-2017-9835 | 7.8 | Jul 26 | The gs_alloc_ref_array function in psi/ialloc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash)… Affected: 9.21 |
| CVE-2017-9611 | 7.8 | Jul 26 | The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application… Affected: 9.21 |
| CVE-2017-7948 | 7.8 | Apr 19 | Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or… Affected: 9.21 |
| CVE-2016-8602 | 7.8 | Apr 14 | The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via… Affected: through 9.20 |
| CVE-2016-10317 | 7.8 | Apr 3 | The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc Affected: 9.20 |
| CVE-2024-29511 | 7.5 | Jul 3 | Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary… Affected: before 10.03.1 |
| CVE-2023-46751 | 7.5 | Dec 6 | An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling… Affected: through 10.02.0 |
| CVE-2020-27792 | 7.1 | Aug 19 | A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file Affected: through 9.50 |
| CVE-2026-103226 | 6.3 | Sep 30 | Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow Affected: 10.07 |
| CVE-2024-33870 | 6.3 | Jul 3 | An issue was discovered in Artifex Ghostscript before 10.03.1 Affected: before 10.03.1 |
| CVE-2024-29510 | 6.3 | Jul 3 | Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device Affected: before 10.03.1 |
| CVE-2018-18073 | 6.3 | Oct 15 | Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object Affected: through 9.25 |
| CVE-2025-59800 | 5.5 | Sep 22 | In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8 Affected: through 10.05.1 |
| CVE-2025-59799 | 5.5 | Sep 22 | Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value Affected: through 10.05.1 |
| CVE-2025-59798 | 5.5 | Sep 22 | Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c Affected: through 10.05.1 |
| CVE-2024-46955 | 5.5 | Nov 10 | An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0 Affected: before 10.04.0 |
| CVE-2023-52722 | 5.5 | Apr 28 | An issue was discovered in Artifex Ghostscript before 10.03.1 Affected: before 10.03.1 |
| CVE-2023-4042 | 5.5 | Aug 23 | A flaw was found in ghostscript Affected: before 9.51 |
| CVE-2020-21710 | 5.5 | Aug 22 | A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a denial of service via opening of crafted… Affected: 9.50 |
| CVE-2023-38560 | 5.5 | Aug 1 | An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript Affected: All versions, or not specified |
| CVE-2023-38559 | 5.5 | Aug 1 | A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript Affected: before 10.02.0 |
| CVE-2022-2085 | 5.5 | Jun 16 | A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory Affected: 9.55.0 |
| CVE-2021-45944 | 5.5 | Jan 1 | Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp) Affected: 9.50 through 9.53.3 |
| CVE-2021-45949 | 5.5 | Dec 31 | Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp) Affected: 9.50 through 9.54.0 |
| CVE-2020-14373 | 5.5 | Sep 3 | A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25 Affected: 9.25 |
| CVE-2020-17538 | 5.5 | Aug 13 | A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of… Affected: 9.18 before 9.52 |
| CVE-2020-16310 | 5.5 | Aug 13 | A division by zero vulnerability in dot24_print_page() in devices/gdevdm24.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a… Affected: 9.50 |
| CVE-2020-16309 | 5.5 | Aug 13 | A buffer overflow vulnerability in lxm5700m_print_page() in devices/gdevlxm.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a… Affected: 9.50 |
| CVE-2020-16308 | 5.5 | Aug 13 | A buffer overflow vulnerability in p_print_image() in devices/gdevcdj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted… Affected: before 9.52; 9.50 |
| CVE-2020-16307 | 5.5 | Aug 13 | A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service… Affected: 9.50 |
| CVE-2020-16306 | 5.5 | Aug 13 | A null pointer dereference vulnerability in devices/gdevtsep.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript… Affected: 9.50 |
| CVE-2020-16305 | 5.5 | Aug 13 | A buffer overflow vulnerability in pcx_write_rle() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a… Affected: 9.50 |
| CVE-2020-16304 | 5.5 | Aug 13 | A buffer overflow vulnerability in image_render_color_thresh() in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to escalate privileges… Affected: 9.18 through 9.52 |
| CVE-2020-16302 | 5.5 | Aug 13 | A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted… Affected: 9.50 |
| CVE-2020-16301 | 5.5 | Aug 13 | A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a… Affected: before 9.52 |
| CVE-2020-16300 | 5.5 | Aug 13 | A buffer overflow vulnerability in tiff12_print_page() in devices/gdevtfnx.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a… Affected: before 9.52 |
| CVE-2020-16299 | 5.5 | Aug 13 | A Division by Zero vulnerability in bj10v_print_page() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service… Affected: before 9.52 |
| CVE-2020-16298 | 5.5 | Aug 13 | A buffer overflow vulnerability in mj_color_correct() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via… Affected: before 9.52 |
| CVE-2020-16297 | 5.5 | Aug 13 | A buffer overflow vulnerability in FloydSteinbergDitheringC() in contrib/gdevbjca.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to cause a denial of… Affected: 9.18 before 9.52 |
| CVE-2020-16296 | 5.5 | Aug 13 | A buffer overflow vulnerability in GetNumWrongData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of… Affected: 9.18 before 9.52 |