CVE-2024-29507: Artifex Ghostscript Buffer Overflow Flaw

CVE-2024-29507 is a stack-based buffer overflow vulnerability in Artifex Ghostscript affecting versions before 10.03.0. This flaw involves the CIDFSubstPath and CIDFSubstFont parameters and poses security risks. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2024-29507 Overview

CVE-2024-29507 is a stack-based buffer overflow vulnerability in Artifex Ghostscript versions before 10.03.0. The flaw occurs when Ghostscript processes the CIDFSubstPath and CIDFSubstFont parameters, which govern substitution paths for CID-keyed fonts. An attacker can craft input that overflows a stack buffer during font substitution handling. Exploitation requires user interaction, typically convincing a user to process a malicious document through Ghostscript. The vulnerability is tracked as [CWE-120] (Classic Buffer Copy without Checking Size of Input). Ghostscript is widely deployed in print pipelines, PDF converters, and server-side document processing services, which increases exposure.

Critical Impact
A successful exploit can corrupt stack memory in the Ghostscript process, enabling limited integrity and availability impact on systems processing untrusted PostScript or PDF content.

Affected Products

Artifex Ghostscript versions prior to 10.03.0
Downstream Linux distributions bundling vulnerable Ghostscript packages
Applications and services that embed Ghostscript for PostScript or PDF rendering

Discovery Timeline

2024-07-03 - CVE-2024-29507 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29507

Vulnerability Analysis

The vulnerability resides in Ghostscript's handling of CID font substitution. When the interpreter processes the CIDFSubstPath and CIDFSubstFont parameters, it copies parameter data into a fixed-size stack buffer without validating the input length. Supplying oversized values corrupts adjacent stack memory, including saved registers and return addresses.

Because Ghostscript frequently runs as a backend for PDF-to-image converters, print spoolers, and web-based document processors, malicious documents can reach the vulnerable code path without direct attacker access to the host. The attack requires user interaction, such as opening or converting a crafted document.

Root Cause

The root cause is missing bounds checking on string parameters consumed during CID font substitution. The affected routines assume parameter length constraints that are not enforced at the input layer. The upstream fix in commit 7745dbe24514 adds length validation before copying parameter data into stack-allocated storage.

Attack Vector

An attacker crafts a PostScript, EPS, or PDF document that supplies malicious values for CIDFSubstPath or CIDFSubstFont. When a victim or server-side process invokes Ghostscript against the document, the parameters trigger the overflow. Impact is constrained to limited integrity and availability loss on the processing host, consistent with the scored CVSS metrics. Detailed reproduction information is available in Ghostscript Bug Report #707510 and the Openwall OSS-Security Discussion.

No verified public exploit code is available at the time of writing. See the Ghostscript Commit Diff #7745dbe for the patch details.

Detection Methods for CVE-2024-29507

Indicators of Compromise

Unexpected crashes or segmentation faults in gs, gsc, or embedded Ghostscript worker processes
Documents containing unusually long CIDFSubstPath or CIDFSubstFont parameter values
Core dumps generated by print spoolers, PDF converters, or document pipelines invoking Ghostscript

Detection Strategies

Inventory hosts running Ghostscript versions below 10.03.0 using software asset management or package queries
Inspect PostScript and PDF inputs reaching document-processing services for abnormally sized CID font substitution parameters
Enable crash telemetry on backend converters and correlate with document ingestion events

Monitoring Recommendations

Forward process crash events from CUPS, Ghostscript workers, and conversion services to a centralized log platform
Alert on repeated Ghostscript process termination tied to a single uploaded document or user session
Monitor outbound network connections initiated by Ghostscript processes, which should not occur in normal rendering workflows

How to Mitigate CVE-2024-29507

Immediate Actions Required

Upgrade Artifex Ghostscript to version 10.03.0 or later on all systems
Apply vendor-provided backport patches for distributions that ship older Ghostscript releases
Restrict document processing services to accept input only from authenticated or trusted sources

Patch Information

The upstream fix is tracked in Ghostscript Commit Diff #7745dbe and documented in Ghostscript Bug Report #707510. Users should install Ghostscript 10.03.0 or a distribution package that incorporates the backported fix.

Workarounds

Run Ghostscript under restrictive sandboxing such as seccomp, AppArmor, or SELinux policies
Disable server-side conversion of untrusted PostScript and PDF content until patches are applied
Use the -dSAFER option, which remains Ghostscript's recommended default for processing untrusted input

bash

# Verify installed Ghostscript version
gs --version

# Example: invoke Ghostscript with SAFER mode and resource restrictions
gs -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pdfwrite \
   -sOutputFile=output.pdf input.pdf