CVE-2021-45944

What it actually does

Use-after-free in sampled_data_sample (called from sampled_data_continue and interp) allows memory corruption during PostScript/PDF interpretation in Ghostscript 9.50-9.53.3, resulting in application crash.

Why it matters to the business

Systems that render or convert documents using Ghostscript may experience sudden failures when handling certain files, disrupting print, conversion, or preview workflows with no data theft risk but possible operational downtime.

How an attack unfolds

An attacker creates a specially crafted PostScript or PDF file that exercises the sampled data path; when the file is opened or processed by an affected Ghostscript instance the use-after-free is triggered, causing the interpreter to crash.

How to fix it

Upgrade Ghostscript to a version newer than 9.53.3 on all affected hosts; rebuild or reinstall any packages that statically link the vulnerable library; test document processing pipelines with the updated binary.

How to confirm the fix worked

Run 'gs --version' and confirm the installed release is newer than 9.53.3; re-process a known-triggering test file and verify the interpreter no longer crashes; scan build artifacts for references to the vulnerable sampled_data functions.

Typical attack path

1. Craft malicious PostScript or PDF input that reaches sampled_data_sample via sampled_data_continue
2. Deliver the file to the target (email, web download, shared storage)
3. Victim or automated process opens the file with Ghostscript 9.50-9.53.3
4. Interpreter follows the sampled data execution path and triggers the dangling reference
5. Process crashes, producing denial of service

How to detect it

Search application and system logs for Ghostscript segmentation faults or abrupt exits while processing PDF or PostScript files; inspect core dumps or crash reports that reference sampled_data_sample or sampled_data_continue; correlate file-processing timestamps with process termination events.

What your security team should do

• Prioritize patching of any internet-facing or high-volume document-processing servers within 30 days
• Add Ghostscript version checks to configuration-management and vulnerability-scanning policies
• Restrict Ghostscript execution to trusted input sources where possible
• Monitor vendor advisories for downstream packages that embed Ghostscript