CVE-2018-16510

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-05 · updated 2026-06-17
Weakness: CWE-119

Description

An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact.

Affected products

Artifex Ghostscript: before 9.24 — fixed in 9.24
Artifex Gpl Ghostscript: before 9.26 — fixed in 9.26
Canonical Ubuntu Linux: 14.04, 16.04, 18.04

How to fix

Upgrade to a fixed version: Artifex Ghostscript 9.24; Artifex Gpl Ghostscript 9.26. Check the vendor advisory for mitigations.

References

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=ea735ba37dc0fd5f5622d031830b9a559dec1cc9
http://openwall.com/lists/oss-security/2018/08/27/4
https://bugs.ghostscript.com/show_bug.cgi?id=699671
https://security.gentoo.org/glsa/201811-12
https://usn.ubuntu.com/3768-1/
https://usn.ubuntu.com/3773-1/
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=ea735ba37dc0fd5f5622d031830b9a559dec1cc9
http://openwall.com/lists/oss-security/2018/08/27/4
https://bugs.ghostscript.com/show_bug.cgi?id=699671
https://security.gentoo.org/glsa/201811-12
https://usn.ubuntu.com/3768-1/
https://usn.ubuntu.com/3773-1/

Get alerted when CVE-2018-16510 or the next vulnerability affects your stack