GH
Product
Ghostscript
On CISA KEVExploited in the wild
130
CVEs
1
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 12High 56Medium 60Low 2
Watch
Add Ghostscript to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-8291 In wildKEV | 7.8 | Apr 27 | Artifex Ghostscript Type Confusion Vulnerability Affected: before 9.21 |
| CVE-2024-33871 | 8.8 | Jul 3 | An issue was discovered in Artifex Ghostscript before 10.03.1 Affected: before 10.03.1 |
| CVE-2024-29509 | 8.8 | Jul 3 | Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle Affected: before 10.03.0 |
| CVE-2024-29506 | 8.8 | Jul 3 | Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name Affected: before 10.03.0 |
| CVE-2023-43115 | 8.8 | Sep 18 | In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or… Affected: through 10.01.2 |
| CVE-2019-14869 | 8.8 | Nov 15 | A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass… Affected: 9.00 before 9.50 |
| CVE-2016-7976 | 8.8 | Aug 7 | The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams Affected: 9.18; 9.20 |
| CVE-2018-18284 | 8.6 | Oct 19 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator Affected: through 9.25 |
| CVE-2018-17961 | 8.6 | Oct 15 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup Affected: before 9.25 |
| CVE-2025-27835 | 7.8 | Mar 25 | An issue was discovered in Artifex Ghostscript before 10.05.0 Affected: before 10.05.0 |
| CVE-2025-27834 | 7.8 | Mar 25 | An issue was discovered in Artifex Ghostscript before 10.05.0 Affected: before 10.05.0 |
| CVE-2025-27833 | 7.8 | Mar 25 | An issue was discovered in Artifex Ghostscript before 10.05.0 Affected: before 10.05.0 |
| CVE-2025-27830 | 7.8 | Mar 25 | An issue was discovered in Artifex Ghostscript before 10.05.0 Affected: before 10.05.0 |
| CVE-2024-46956 | 7.8 | Nov 10 | An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0 Affected: before 10.04.0 |
| CVE-2024-46954 | 7.8 | Nov 10 | An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0 Affected: before 10.04.0 |
| CVE-2024-46953 | 7.8 | Nov 10 | An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0 Affected: before 10.04.0 |
| CVE-2024-46952 | 7.8 | Nov 10 | An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0 Affected: before 10.04.0 |
| CVE-2024-46951 | 7.8 | Nov 10 | An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0 Affected: before 10.04.0 |
| CVE-2020-21890 | 7.8 | Aug 22 | Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of service or other unspecified… Affected: 9.50 |
| CVE-2023-36664 | 7.8 | Jun 25 | Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix) Affected: before 10.01.2 |
| CVE-2019-25059 | 7.8 | Apr 25 | Artifex Ghostscript through 9.26 mishandles .completefont Affected: through 9.26 |
| CVE-2020-16303 | 7.8 | Aug 13 | A use-after-free vulnerability in xps_finish_image_path() in devices/vector/gdevxps.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a… Affected: 9.50 |
| CVE-2019-14812 | 7.8 | Nov 27 | A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass… Affected: 9.00 before 9.50 |
| CVE-2019-10216 | 7.8 | Nov 27 | In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions Affected: before 9.50 |
| CVE-2019-14817 | 7.8 | Sep 3 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to… Affected: before 9.50 |
| CVE-2019-14811 | 7.8 | Sep 3 | A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass… Affected: before 9.50 |
| CVE-2019-3839 | 7.8 | May 16 | It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix Affected: before 9.27 |
| CVE-2019-6116 | 7.8 | Mar 19 | In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution Affected: through 9.26 |
| CVE-2018-19134 | 7.8 | Dec 20 | In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types Affected: through 9.25 |
| CVE-2018-16863 | 7.8 | Dec 3 | It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509 Affected: 9.07 |
| CVE-2018-19477 | 7.8 | Nov 23 | psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion Affected: before 9.26 |
| CVE-2018-19476 | 7.8 | Nov 23 | psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion Affected: before 9.26 |
| CVE-2018-19475 | 7.8 | Nov 23 | psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device… Affected: before 9.26 |
| CVE-2018-17183 | 7.8 | Sep 19 | Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite… Affected: before 9.25 |
| CVE-2018-16802 | 7.8 | Sep 10 | An issue was discovered in Artifex Ghostscript before 9.25 Affected: before 9.25 |
| CVE-2018-16585 | 7.8 | Sep 6 | An issue was discovered in Artifex Ghostscript before 9.24 Affected: before 9.24 |
| CVE-2018-16543 | 7.8 | Sep 5 | In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact Affected: before 9.24 |
| CVE-2018-16540 | 7.8 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the… Affected: before 9.24 |
| CVE-2018-16513 | 7.8 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have… Affected: before 9.24 |
| CVE-2018-16511 | 7.8 | Sep 5 | An issue was discovered in Artifex Ghostscript before 9.24 Affected: before 9.24 |
| CVE-2018-16510 | 7.8 | Sep 5 | An issue was discovered in Artifex Ghostscript before 9.24 Affected: before 9.24 |
| CVE-2018-16509 | 7.8 | Sep 5 | An issue was discovered in Artifex Ghostscript before 9.24 Affected: before 9.24 |
| CVE-2018-15911 | 7.8 | Aug 28 | In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter… Affected: through 9.23 |
| CVE-2018-15910 | 7.8 | Aug 27 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or… Affected: before 9.24 |
| CVE-2018-15909 | 7.8 | Aug 27 | In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the… Affected: through 9.23 |
| CVE-2018-15908 | 7.8 | Aug 27 | In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files Affected: through 9.23 |
| CVE-2018-10194 | 7.8 | Apr 18 | The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning… Affected: through 9.22 |
| CVE-2017-11714 | 7.8 | Jul 28 | psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or… Affected: 9.21 |
| CVE-2017-9835 | 7.8 | Jul 26 | The gs_alloc_ref_array function in psi/ialloc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash)… Affected: 9.21 |
| CVE-2017-9611 | 7.8 | Jul 26 | The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application… Affected: 9.21 |