CVE-2017-8291

What it actually does

Type confusion in .rsdparams handling allows -dSAFER sandbox bypass in Ghostscript, enabling arbitrary command execution when an EPS file contains a crafted /OutputFile (%pipe% substring.

Why it matters to the business

Attackers can achieve remote code execution on any system processing untrusted EPS files with vulnerable Ghostscript, resulting in full host compromise. High EPSS and historical KEV listing indicate real-world risk, though the issue is over seven years old and most environments are already updated.

How an attack unfolds

An attacker crafts an EPS document embedding the /OutputFile (%pipe% directive, delivers it to a target (email, web download, or document workflow), and triggers processing by the gs binary or any application linking Ghostscript; the type confusion bypasses the sandbox and spawns attacker-controlled commands. The flaw was exploited in the wild in April 2017.

How to fix it

Upgrade Ghostscript to a build dated after 2017-04-26. The listed py3-pip-wheel packages (Chainguard and Wolfi) are already fixed in version 0; ensure any downstream consumers pull the corrected package and rebuild images.

How to confirm the fix worked

Run gs --version to confirm build date after April 2017; attempt to process a test EPS containing the pipe directive and verify that -dSAFER still blocks execution.

Typical attack path

1. Create malicious EPS containing /OutputFile (%pipe% substring
2. Deliver file to victim via email attachment or web link
3. Victim or automated process opens the file with gs or a Ghostscript-dependent application
4. Type confusion triggers sandbox bypass and executes shell commands
5. Attacker establishes persistence or exfiltrates data

How to detect it

Search process-creation logs for gs or ghostscript binaries spawning shells or network tools immediately after EPS file access; inspect email gateways and document repositories for files containing the literal string /OutputFile (%pipe%.

• /OutputFile (%pipe%
• gs.*-dSAFER.*.eps
• ghostscript.*pipe

What your security team should do

• Confirm no remaining Ghostscript instances pre-date 2017-04-26 in container or host fleets
• Block or sandbox all EPS/PostScript processing from untrusted sources
• Add the historical KEV due date (2022-06-14) to any legacy-asset review backlog
• Scan build pipelines for direct or transitive Ghostscript dependencies