CVE-2016-10317

What it actually does

Heap-based buffer overflow in the fill_threshhold_buffer function triggered by specially crafted PostScript input leading to memory corruption.

Why it matters to the business

Processing untrusted documents can crash the application or allow arbitrary code execution, disrupting document workflows and risking full system compromise on affected hosts.

How an attack unfolds

An attacker supplies a malicious PostScript file that reaches the vulnerable threshold buffer logic during rendering; the overflow corrupts heap memory and can be leveraged for code execution or denial of service.

How to fix it

Upgrade to a Ghostscript release after 9.20 that contains the corrected gxht_thresh.c logic; remove or sandbox older interpreters where feasible.

How to confirm the fix worked

Confirm Ghostscript version is newer than 9.20, run regression tests with known trigger documents, and verify the application no longer crashes on the crafted input.

Typical attack path

1. Attacker creates a crafted PostScript document containing malformed threshold data.
2. Victim or automated process opens the document with an affected Ghostscript version.
3. fill_threshhold_buffer processes the input and overflows the heap buffer.
4. Memory corruption is used to achieve code execution or crash the interpreter.

How to detect it

Review process execution logs and application crashes for Ghostscript invocations on unexpected PostScript files; correlate with file creation or download events preceding the crash.

What your security team should do

• Immediately replace any Ghostscript 9.20 or earlier installations with a supported version.
• Disable or restrict PostScript processing for untrusted input sources.
• Add file-type filtering or sandboxing around document conversion pipelines.