CVE-2023-28879

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-31 · updated 2026-06-17
Weakness: CWE-787

Description

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.

Affected products

Artifex Ghostscript: before 10.01.0 — fixed in 10.01.0
Debian Linux: 10.0, 11.0

How to fix

Upgrade to a fixed version: Artifex Ghostscript 10.01.0. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2023/04/12/4
https://bugs.ghostscript.com/show_bug.cgi?id=706494
https://ghostscript.readthedocs.io/en/latest/News.html
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179
https://lists.debian.org/debian-lts-announce/2023/04/msg00003.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CI6UCKM3XMK7PYNIRGAVDJ5VKN6XYZOE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHJX62KSRIOBZA6FKONMJP7MEFY7LTH2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MADLP3GWJFLLFVNZGEDNPMDQR6CCXAHN/
https://security.gentoo.org/glsa/202309-03
https://www.debian.org/security/2023/dsa-5383
http://www.openwall.com/lists/oss-security/2023/04/12/4
https://bugs.ghostscript.com/show_bug.cgi?id=706494

Get alerted when CVE-2023-28879 or the next vulnerability affects your stack