CVE-2024-29509

What it actually does

Heap-based buffer overflow triggered when PDFPassword contains a null byte in the middle during PDF processing operations such as runpdf.

Why it matters to the business

Processing of malicious PDF files can lead to arbitrary code execution or application crashes, potentially exposing sensitive documents or disrupting document-handling workflows in environments that rely on Ghostscript.

How an attack unfolds

An attacker creates a PDF file containing a PDFPassword field with an embedded null byte, then delivers the file to a target system. When Ghostscript processes the PDF (for example via runpdf), the null byte causes a heap overflow that an attacker can leverage for code execution.

How to fix it

Upgrade Artifex Ghostscript to version 10.03.0 or later. Verify the installed version and replace any instances of earlier releases.

How to confirm the fix worked

Confirm Ghostscript reports version 10.03.0 or newer. Test processing of a PDF containing a null byte in PDFPassword to ensure no crash or overflow occurs.

Typical attack path

1. Craft a malicious PDF embedding a null byte within the PDFPassword field
2. Deliver the PDF to a victim via email, download, or shared storage
3. Victim opens or processes the PDF using Ghostscript before version 10.03.0
4. Heap overflow occurs allowing attacker-controlled memory corruption and potential code execution

How to detect it

Review process execution logs and file access records for Ghostscript invocations on untrusted PDFs; look for crashes or unexpected memory behavior during PDF password handling.

What your security team should do

• Immediately update all Ghostscript installations to 10.03.0 or newer
• Inventory systems and applications that invoke Ghostscript for PDF handling
• Block or sandbox untrusted PDF processing until patches are applied
• Monitor for new exploit development given the memory corruption nature of the flaw