CVE-2024-46956: Artifex Ghostscript RCE Vulnerability

CVE-2024-46956 Overview

CVE-2024-46956 is an out-of-bounds read vulnerability in psi/zfile.c of Artifex Ghostscript before version 10.04.0. The filenameforall operator performs out-of-bounds data access that attackers can leverage to achieve arbitrary code execution. Ghostscript is an interpreter for PostScript and PDF that ships as a core component of many Linux distributions and document processing pipelines. Successful exploitation requires a user to process an attacker-supplied file locally, which places rendering hosts, print servers, and any application that shells out to Ghostscript in scope.

Critical Impact
Processing a crafted PostScript or PDF file with a vulnerable Ghostscript version can lead to arbitrary code execution in the context of the invoking user.

Affected Products

Artifex Ghostscript versions prior to 10.04.0
Debian Linux 12.0
SUSE Linux Enterprise Server 12 SP5 (including LTSS and LTSS Extended Security), SUSE Linux Enterprise High Performance Computing 12 SP5, and SUSE Linux Enterprise Server for SAP 12 SP5

Discovery Timeline

2024-11-10 - CVE-2024-46956 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-46956

Vulnerability Analysis

The flaw resides in psi/zfile.c, which implements PostScript file operators in the Ghostscript interpreter. The filenameforall operator iterates over filenames matching a pattern and executes a procedure for each match. In vulnerable builds, the implementation reads data outside the allocated bounds of an internal buffer while handling the pattern or the enumeration state. The condition is classified under [CWE-125] Out-of-Bounds Read.

Out-of-bounds reads in the PostScript interpreter are not limited to information disclosure. Because Ghostscript exposes interpreter state through the operand and dictionary stacks, an attacker who controls the read primitive can steer interpreter behavior, corrupt object references, and pivot to arbitrary code execution. The upstream fix landed in commit f4151f12db32cd3ed26c24327de714bf2c3ed6ca and is included in Ghostscript 10.04.0.

Root Cause

The root cause is missing bounds validation inside the filenameforall implementation in psi/zfile.c. Filename enumeration paths dereference memory beyond the intended buffer when specific pattern inputs are supplied, allowing adjacent heap or stack data to influence interpreter state during the enumeration callback.

Attack Vector

Exploitation requires local access and user interaction: a user must open or process a crafted PostScript, EPS, or PDF file with a vulnerable Ghostscript build. Common triggers include command-line invocations of gs, print-spooler workflows, thumbnailers, and image-conversion tools such as ImageMagick that delegate to Ghostscript. No authentication or elevated privileges are required from the attacker; the code executes with the privileges of the user running Ghostscript.

No public proof-of-concept exploit or exploit database entry is available at this time. See the Ghostscript Bug Report #707895 and the upstream fix commit for technical details.

Detection Methods for CVE-2024-46956

Indicators of Compromise

Unexpected child processes spawned by gs, gsc, or gswin32c.exe, particularly shells, interpreters, or network utilities
PostScript or PDF files containing unusual filenameforall operator patterns delivered through email, print queues, or document conversion pipelines
Ghostscript crashes with segmentation faults recorded in dmesg, journalctl, or application logs on servers that render user-supplied documents

Detection Strategies

Inventory installed Ghostscript versions across Linux and Windows hosts and flag any build earlier than 10.04.0 or an unpatched distribution package
Monitor process-lineage telemetry for gs parents launching non-rendering binaries such as /bin/sh, bash, python, or curl
Correlate document-processing workloads (print servers, CUPS filters, ImageMagick delegates) with process crashes and outbound network connections in the same time window

Monitoring Recommendations

Enable auditd or EDR rules that alert when the Ghostscript binary writes to user home directories, /tmp, or /var/spool and subsequently executes those files
Log and review invocations of gs with -dNOSAFER or with input from network-facing directories, which broaden the impact of any code execution primitive
Track package updates for ghostscript and libgs in configuration-management tooling to confirm timely patch deployment

How to Mitigate CVE-2024-46956

Immediate Actions Required

Upgrade Artifex Ghostscript to version 10.04.0 or later on every affected host and container image
Apply distribution updates from the SUSE update announcement and the Debian LTS announcement for packaged Ghostscript builds
Audit downstream applications that bundle or invoke Ghostscript, including ImageMagick, CUPS, and PDF-to-image workflows, to ensure they resolve to the patched binary

Patch Information

The vulnerability is fixed upstream in Ghostscript commit f4151f12db32cd3ed26c24327de714bf2c3ed6ca, released in version 10.04.0. Refer to the Ghostscript commit page and the GitHub News Update for release notes. Vendor packages from Debian and SUSE include backported fixes for supported LTS branches.

Workarounds

Restrict Ghostscript to the default -dSAFER sandbox and avoid passing -dNOSAFER when processing untrusted input
Disable or gate document-conversion services that accept user-uploaded PostScript, EPS, or PDF files until the patched Ghostscript version is deployed
Run Ghostscript inside a low-privilege service account or a container with seccomp and read-only filesystem constraints to limit the blast radius of code execution

bash

# Verify the installed Ghostscript version and upgrade on Debian-based systems
gs --version
sudo apt update && sudo apt install --only-upgrade ghostscript libgs10

# Confirm SAFER mode is enforced when invoking Ghostscript
gs -dSAFER -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=out.pdf input.ps