| 제목 | Artifex Software Ghostscript (GhostPDL) 8.00 (2002) up to 10.09.0 / master (2026-08-21) Stack-based Buffer Overflow |
|---|
| 설명 | A stack-based buffer overflow exists in Ghostscript's pdfwrite Type 1 font embedding path. The minimal Type 1 charstring interpreter in devices/vector/gdevpsfx.c pushes entries onto the interpreter position stack (ipstack) in type1_callsubr() without any upper-bound check, while the corresponding return operator is only guarded on the lower bound. ipstack is a fixed 11-entry array inside gs_type1_state, which psf_convert_type1_to_type2() allocates on the C stack, so each nested callsubr from a crafted Type 1 font writes an 80-byte structure past the end of a stack object, with attacker-controlled nesting depth. A PostScript or PDF file containing such a font, processed with -sDEVICE=pdfwrite, causes a deterministic SIGSEGV on default non-sanitizer builds. Confirmed present from 8.00 (2002) through the latest master (commit 3bd9e56f,
2026-08-21) — a 24-year-old unfixed defect.The vendor has acknowledged the vulnerability: the report was filed confidentially via bugs.ghostscript.com on 2026-08-25, and Ghostscript maintainer Ken Sharp confirmed and accepted it the same day ("Thanks for the report"), stating he fixed it by applying the CS_CHECK_IPSTACK bounds-checking macro in the font parsing loop, crediting the reporter by Bugzilla ID in the commit log. The bug is currently IN_PROGRESS; it will be marked FIXED when a release containing the fix ships, followed by public disclosure of the report a few days later. CVSS 3.1: 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). |
|---|
| 원천 | ⚠️ https://bugs.ghostscript.com/show_bug.cgi?id=709672 |
|---|
| 사용자 | zzxzzb (UID 95450) |
|---|
| 제출 | 2026. 09. 01. AM 09:46 (29 날 ago) |
|---|
| 모더레이션 | 2026. 09. 30. AM 09:40 (29 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 411906 [Artifex Ghostscript 까지 10.09.0 Pdfwrite gdevpsfx.c type1_callsubr 메모리 손상] |
|---|
| 포인트들 | 17 |
|---|