CVE-2024-46955

What it actually does

Out-of-bounds read in psi/zcolor.c when processing color values in an Indexed color space, allowing access to adjacent memory regions during PostScript/PDF rendering.

Why it matters to the business

Processing untrusted documents can cause application crashes or unintended memory disclosure, disrupting document workflows and potentially exposing sensitive data in environments that rely on Ghostscript for rendering or conversion.

How an attack unfolds

An attacker creates a crafted PDF or PostScript file containing an improperly defined Indexed color space. When Ghostscript parses the color lookup table, the out-of-bounds read occurs, potentially leaking memory contents or triggering a crash that an attacker could leverage for further attacks.

How to fix it

Upgrade Artifex Ghostscript / GhostPDL to the version containing commit df8f4966577fff70320be2eb33cb55eb15d05d52 (equivalent to 10.04.0 or later). Rebuild any dependent packages and restart services that invoke Ghostscript for document processing.

How to confirm the fix worked

Confirm the installed Ghostscript binary reports version 10.04.0 or newer, or verify the source tree contains commit df8f4966577fff70320be2eb33cb55eb15d05d52. Test rendering of sample files containing Indexed color spaces to ensure no crashes occur.

Typical attack path

1. Attacker crafts a malicious PDF or PostScript document with malformed Indexed color space data
2. Document is delivered to the target via email, web download, or file share
3. Victim or automated process opens the document using Ghostscript or a dependent application
4. Ghostscript parses the color space in zcolor.c, triggering the out-of-bounds read
5. Attacker observes crash or extracts leaked memory to advance the attack

How to detect it

Review application logs for Ghostscript crashes or segmentation faults during PDF/PostScript processing. Monitor for unexpected memory usage spikes or error messages referencing color space handling in zcolor.c. No public exploitation artifacts are known.

What your security team should do

• Immediately update all Ghostscript installations to the fixed commit or 10.04.0 release
• Scan internal repositories and build pipelines for older Ghostscript versions
• Add Ghostscript version checks to vulnerability scanning and software bill-of-materials processes
• Restrict Ghostscript execution to trusted input sources until patches are applied