CVE-2024-29508

What it actually does

Heap-based pointer disclosure in pdf_base_font_alloc function, observable via constructed BaseFont name during PDF processing.

Why it matters to the business

Local users may extract limited memory address information from Ghostscript PDF workflows, potentially aiding follow-on attacks in environments processing untrusted documents.

How an attack unfolds

An attacker with local access supplies a specially crafted PDF or font input that triggers pdf_base_font_alloc, then inspects the resulting BaseFont name to observe leaked heap pointers.

How to fix it

Upgrade Artifex Ghostscript to version 10.03.0 or later; rebuild any dependent packages and re-validate PDF processing pipelines.

How to confirm the fix worked

Confirm installed Ghostscript version is 10.03.0 or newer; test PDF rendering with crafted BaseFont inputs and verify absence of pointer leakage in output names.

Typical attack path

1. Obtain local access to a system running vulnerable Ghostscript
2. Craft or obtain a PDF containing a malicious BaseFont definition
3. Process the input via Ghostscript to trigger pdf_base_font_alloc
4. Inspect the generated BaseFont name to capture disclosed heap pointers
5. Use pointer information to inform subsequent exploitation attempts

How to detect it

Review application logs and process output for unexpected BaseFont name patterns containing pointer-like values; correlate with Ghostscript invocation timestamps on systems handling untrusted PDFs.

What your security team should do

• Prioritize upgrade of Ghostscript to 10.03.0 across all systems processing PDFs
• Inventory and update downstream applications that embed or call Ghostscript
• Restrict local user access to Ghostscript binaries where feasible
• Monitor EPSS trend and revisit if exploit code appears