CVE-2024-46951

What it actually does

Unchecked Implementation pointer dereference in Pattern color space handling within psi/zcolor.c allows out-of-bounds memory access and potential control-flow hijacking leading to arbitrary code execution.

Why it matters to the business

Attackers could execute arbitrary code on systems that render or process untrusted PostScript and PDF documents, risking compromise of document conversion, printing, and preview pipelines with potential data theft or malware deployment.

How an attack unfolds

An attacker supplies a crafted PDF or PostScript file containing a malformed Pattern color space object; when Ghostscript parses the color space the unchecked pointer is dereferenced, corrupting memory and allowing the attacker to redirect execution to attacker-controlled code.

How to fix it

Upgrade Artifex Ghostscript to version 10.04.0 or later; the specific fix is present in commit df8f4966577fff70320be2eb33cb55eb15d05d52. Rebuild any downstream packages that embed Ghostscript and validate the updated binary reports version 10.04.0 or newer.

How to confirm the fix worked

Execute 'gs --version' and confirm output is 10.04.0 or greater; run regression test suites against sample Pattern color space files and verify no crashes or unexpected behavior occur on previously vulnerable inputs.

Typical attack path

1. Deliver malicious PDF/PostScript via email, web download, or shared file
2. Victim application invokes Ghostscript to interpret or rasterize the document
3. Parser reaches Pattern color space handling and dereferences the invalid Implementation pointer
4. Memory corruption is leveraged to achieve code execution within the Ghostscript process
5. Attacker payload establishes persistence or exfiltrates data from the compromised host

How to detect it

Review process execution logs and file-access telemetry for Ghostscript invocations against untrusted documents; look for crashes or segmentation faults in gs or ghostscript processes around the time of document processing.

What your security team should do

• Immediately update all Ghostscript installations to 10.04.0 or later
• Inventory and replace any embedded or statically linked copies of Ghostscript in third-party applications
• Restrict Ghostscript invocation to trusted input sources until patching is complete
• Monitor EPSS and KEV status for any future increase in exploit activity