CVE-2024-29507

What it actually does

Stack-based buffer overflow triggered when processing oversized or malformed CIDFSubstPath and CIDFSubstFont parameter values in PostScript or PDF input.

Why it matters to the business

Processing untrusted documents can crash rendering services or allow arbitrary code execution, disrupting document workflows, print services, and any downstream systems that rely on Ghostscript for conversion or viewing.

How an attack unfolds

An attacker crafts a PostScript or PDF file containing excessively long values for the CIDFSubstPath or CIDFSubstFont parameters. When Ghostscript parses the file, the oversized data overwrites the stack, potentially leading to a crash or control-flow hijack that executes attacker-supplied code.

How to fix it

Upgrade Ghostscript to version 10.03.0 or later. Where immediate upgrade is not possible, restrict Ghostscript to trusted input only or sandbox its execution.

How to confirm the fix worked

Confirm the installed Ghostscript version is 10.03.0 or newer; re-test with known-malformed CIDFSubstPath/CIDFSubstFont test cases to verify the overflow no longer occurs.

Typical attack path

1. Deliver a malicious PostScript/PDF file to a target that invokes Ghostscript (email attachment, web upload, print queue, document converter).
2. Ghostscript opens and parses the supplied file, reaching the CIDFSubstPath or CIDFSubstFont handling code.
3. The oversized parameter value overflows the stack buffer, corrupting adjacent control data.
4. Execution is redirected to attacker-controlled code or the process crashes, achieving denial of service or remote code execution.

How to detect it

Monitor application and system logs for Ghostscript segmentation faults, stack-smashing detections, or abnormal termination when processing PDF/PostScript files; review any security tooling that inspects document conversion pipelines for unexpected process crashes.

What your security team should do

• Prioritize upgrade of all Ghostscript installations to 10.03.0 or newer within normal change windows.
• Add Ghostscript version checks to vulnerability scanning and asset inventory processes.
• Restrict or sandbox Ghostscript usage when processing untrusted documents until upgrades are complete.