CVE-2016-9601

What it actually does

Heap-based buffer overflow in jbig2_decode_gray_scale_image function during JBIG2 halftone segment decoding, resulting in segmentation fault on malformed input.

Why it matters to the business

Disrupts document processing pipelines and print workflows that rely on Ghostscript, causing application crashes and potential denial of service for PDF/PostScript handling across many systems.

How an attack unfolds

An attacker crafts a JBIG2 image containing malformed halftone segments, embeds it inside a PostScript or PDF document, and delivers the file to a target system. Ghostscript processes the embedded image, triggering the overflow and crash.

How to fix it

Upgrade Ghostscript to version 9.21 or newer on all affected systems; replace or isolate any remaining instances of artifex gpl ghostscript or jbig2dec prior to that release. Restrict processing of untrusted documents until patched.

How to confirm the fix worked

Run 'gs --version' to confirm release 9.21 or later; reprocess known-good and known-bad sample documents to verify absence of crashes.

Typical attack path

1. Create malicious JBIG2 image with crafted halftone data
2. Embed image inside PDF or PostScript document
3. Deliver document via email, web download, or file share
4. Victim system opens document with vulnerable Ghostscript

How to detect it

Monitor process logs and system crash reports for Ghostscript segmentation faults during PDF or PostScript handling; search for repeated invocations of jbig2_decode_gray_scale_image in stack traces.

What your security team should do

• Prioritize upgrade of Ghostscript across all environments given the multi-year exposure window
• Implement sandboxing or container isolation for document processing services
• Add file-type filtering or pre-scanning for JBIG2 content in inbound documents
• Review and retire any remaining pre-9.21 deployments