GH
Product
Ghostscript
On CISA KEVExploited in the wild
130
CVEs
1
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 12High 56Medium 60Low 2
Watch
Add Ghostscript to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3781 | 9.9 | Feb 16 | A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command Affected: 9.50; 9.52; 9.53.3; 9.54.0 |
| CVE-2025-27837 | 9.8 | Mar 25 | An issue was discovered in Artifex Ghostscript before 10.05.0 Affected: before 10.05.0 |
| CVE-2025-27836 | 9.8 | Mar 25 | An issue was discovered in Artifex Ghostscript before 10.05.0 Affected: before 10.05.0 |
| CVE-2025-27832 | 9.8 | Mar 25 | An issue was discovered in Artifex Ghostscript before 10.05.0 Affected: before 10.05.0 |
| CVE-2025-27831 | 9.8 | Mar 25 | An issue was discovered in Artifex Ghostscript before 10.05.0 Affected: before 10.05.0 |
| CVE-2020-36773 | 9.8 | Feb 4 | Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can… Affected: 9.51; 9.52; 9.52.1; 9.53.0; 9.53.0 |
| CVE-2023-28879 | 9.8 | Mar 31 | In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c Affected: before 10.01.0 |
| CVE-2020-15900 | 9.8 | Jul 28 | A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52 Affected: 9.50; 9.52 |
| CVE-2019-14813 | 9.8 | Sep 6 | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass… Affected: 9.00 through 9.50 |
| CVE-2018-19409 | 9.8 | Nov 21 | An issue was discovered in Artifex Ghostscript before 9.26 Affected: before 9.26 |
| CVE-2016-7979 | 9.8 | May 23 | Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in… Affected: through 9.20 |
| CVE-2016-7978 | 9.8 | May 23 | Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice Affected: 9.20 |
Showing 12