CVE-2023-46751

What it actually does

Use-after-free in gdev_prn_open_printer_seekable allows a dangling pointer dereference that crashes the Ghostscript process when handling crafted input.

Why it matters to the business

Systems that render or convert PostScript/PDF documents with Ghostscript can be forced offline, interrupting document workflows and print services until the process is restarted.

How an attack unfolds

An unauthenticated remote attacker supplies a specially crafted input stream that reaches gdev_prn_open_printer_seekable, leaving a dangling pointer which is later dereferenced, resulting in an immediate crash.

How to fix it

Upgrade Artifex Ghostscript to the newest release that contains the fix for this dangling-pointer issue; if no fixed version is available for your distribution, apply vendor patches or replace Ghostscript with an unaffected alternative until an update can be installed.

How to confirm the fix worked

Confirm the installed Ghostscript version is newer than 10.02.0, then attempt to process a known-triggering test file in a controlled environment and verify the process no longer crashes.

Typical attack path

1. Attacker sends malicious PostScript or PDF content to any service that invokes Ghostscript
2. Input reaches the printer device initialization path
3. gdev_prn_open_printer_seekable is called and creates a dangling pointer
4. Subsequent dereference triggers a segmentation fault and process termination

How to detect it

Review application and system logs for Ghostscript segmentation faults or abrupt process exits immediately after document-processing requests; correlate with inbound files or network sessions that triggered the crash.

What your security team should do

• Inventory all hosts and containers running Ghostscript and prioritize update of internet-facing or high-volume document-processing systems
• Add version checks to software bill-of-materials and CI pipelines
• Monitor crash logs for Ghostscript segmentation faults as a temporary detection measure