CVE-2024-46951: Artifex Ghostscript RCE Vulnerability

CVE-2024-46951 Overview

CVE-2024-46951 affects Artifex Ghostscript versions prior to 10.04.0. The vulnerability resides in psi/zcolor.c, where an unchecked Implementation pointer in the Pattern color space can lead to arbitrary code execution. Ghostscript processes PostScript and PDF documents across many Linux distributions and print pipelines, which broadens the exposure. A crafted document can trigger the flaw when a user opens or converts it with a vulnerable Ghostscript build. The issue is tracked under CWE-824: Access of Uninitialized Pointer and has been addressed by upstream Artifex, Debian, and SUSE.

Critical Impact
A crafted PostScript or PDF file processed by a vulnerable Ghostscript instance can achieve arbitrary code execution in the context of the invoking user.

Affected Products

Artifex Ghostscript versions before 10.04.0
Debian Linux 12 (fixed via Debian LTS advisory)
SUSE Linux Enterprise Server 12 SP5, SLES for SAP 12 SP5, and SLE HPC 12 SP5

Discovery Timeline

2024-11-10 - CVE-2024-46951 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-46951

Vulnerability Analysis

Ghostscript implements PostScript color spaces, including the Pattern color space, through internal dispatch tables that expose an Implementation pointer. In psi/zcolor.c, this Implementation pointer was consumed without validating that it referenced a properly initialized structure. Attackers can supply a document that manipulates Pattern color space parameters so the pointer references attacker-controlled data. When the interpreter dereferences the Implementation pointer, control flow can be redirected into memory the attacker influences. Because Ghostscript is regularly invoked by document viewers, print spoolers, and image conversion pipelines such as ImageMagick, the vulnerability extends far beyond direct Ghostscript users. Exploitation requires local user interaction, typically opening or processing a malicious file.

Root Cause

The root cause is access of an uninitialized or unchecked pointer in the Pattern color space handling code. The interpreter trusted the Implementation field supplied by the PostScript state instead of validating it against the expected object layout. This class of defect maps directly to CWE-824. The upstream fix, committed as f4981218, adds the missing validation on the Implementation pointer before it is dereferenced.

Attack Vector

An attacker crafts a PostScript, EPS, or PDF file that manipulates the Pattern color space definition. The victim opens the file, or an automated pipeline such as a print server, thumbnailer, or image converter processes it. Ghostscript reads the malformed color space, dereferences the unchecked Implementation pointer, and executes attacker-influenced code in the user context. No network access or elevated privileges are required prior to exploitation.

No public proof-of-concept exploit or in-the-wild exploitation has been reported. Technical details are available in the Ghostscript bug report 707991 and the Ghostscript News document.

Detection Methods for CVE-2024-46951

Indicators of Compromise

Ghostscript (gs) processes spawning unexpected child processes such as sh, bash, python, or network utilities during document conversion.
PostScript or PDF files containing unusual Pattern color space definitions with malformed or oversized Implementation dictionaries.
Crashes or segmentation faults in gs when opening user-supplied documents, logged by journalctl or dmesg.

Detection Strategies

Inventory installed Ghostscript versions across Linux hosts and print servers using package managers (dpkg -l ghostscript, rpm -q ghostscript) and flag versions earlier than 10.04.0.
Monitor process ancestry for gs, gsc, or wrappers such as ps2pdf, pdf2ps, and ImageMagick convert spawning shells or network binaries.
Inspect PostScript and PDF inputs at mail gateways and file transfer choke points for suspicious Pattern color space constructs.

Monitoring Recommendations

Enable auditd or eBPF-based process monitoring on hosts that render documents to capture Ghostscript execution chains.
Alert on Ghostscript writing to unusual locations such as /tmp executables, cron directories, or user autostart paths.
Track outbound network connections initiated by gs or its parent document-processing services, which should normally have none.

How to Mitigate CVE-2024-46951

Immediate Actions Required

Upgrade Artifex Ghostscript to version 10.04.0 or later on all endpoints, servers, and container images.
Apply distribution updates from the SUSE security update SUSE-SU-2024:3942-1 and the Debian LTS announcement.
Audit downstream applications (CUPS, ImageMagick, GIMP, LibreOffice) that bundle or invoke Ghostscript and update them accordingly.

Patch Information

The upstream fix is available in the Ghostscript commit f49812186baa7d1362880673408a6fbe8719b4f8 and included in Ghostscript 10.04.0. Debian and SUSE have shipped backported packages via their respective security channels. Container base images should be rebuilt to pull the updated package.

Workarounds

Restrict processing of untrusted PostScript, EPS, and PDF files until patches are deployed, especially in automated conversion pipelines.
Run Ghostscript under a low-privilege service account and isolate it with sandboxing tools such as firejail, bubblewrap, or seccomp profiles.
Where feasible, use Ghostscript's -dSAFER mode (default in 9.50+) to reduce the impact of malicious operators, while recognizing that -dSAFER alone does not remediate this defect.

bash

# Verify Ghostscript version and update on Debian/SUSE
gs --version
sudo apt-get update && sudo apt-get install --only-upgrade ghostscript   # Debian
sudo zypper refresh && sudo zypper patch                                  # SUSE

# Run Ghostscript with SAFER and a restricted sandbox
firejail --seccomp --private gs -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pdfwrite \
  -sOutputFile=/tmp/out.pdf /path/to/untrusted.ps