CVE-2023-52722

What it actually does

Bypasses SAFER mode restrictions in the PostScript interpreter by permitting non-standard eexec seeds in Type 1 font handling within psi/zmisc1.c, enabling unauthorized operations on the host system.

Why it matters to the business

Systems that process untrusted PostScript or PDF documents with Ghostscript risk unauthorized file modifications or integrity violations, increasing exposure for document-handling workflows and downstream applications.

How an attack unfolds

An attacker creates a PostScript file containing a non-standard eexec seed, then convinces a user to open the file with Ghostscript running in SAFER mode, allowing the interpreter to execute operations that would otherwise be blocked.

How to fix it

Upgrade Ghostscript to version 10.03.1 or later; for the GIT package apply commit 865d8905b3fdb3a0fabe3628a67bad634cf88ba9.

How to confirm the fix worked

Verify the installed Ghostscript version is 10.03.1 or newer; test processing of sample documents that use non-standard eexec seeds to confirm the bypass is blocked.

Typical attack path

1. Craft a PostScript document embedding a non-standard eexec seed
2. Deliver the document through email, web download, or shared storage
3. Victim opens the file using Ghostscript with SAFER enabled
4. Interpreter accepts the seed and bypasses intended restrictions
5. Perform unauthorized file or system operations

How to detect it

Review process execution logs for Ghostscript invocations on external documents and monitor for unexpected file writes or permission changes following document rendering.

What your security team should do

• Prioritize upgrade of all Ghostscript installations to the fixed version
• Restrict Ghostscript execution on untrusted document sources until patched
• Inventory dependent applications and rebuild any static builds