CVE-2024-46956

What it actually does

Out-of-bounds data access in the filenameforall operator in psi/zfile.c allows memory corruption that can be leveraged for arbitrary code execution.

Why it matters to the business

Attackers can fully compromise systems that process untrusted PostScript, PDF, or EPS files with Ghostscript, resulting in data theft, ransomware deployment, or persistent access without user interaction.

How an attack unfolds

An attacker crafts a malicious input file containing a filenameforall call with specially chosen parameters that trigger an out-of-bounds access during directory enumeration. The corrupted memory state is then used to redirect control flow and execute attacker-supplied code within the Ghostscript interpreter process.

How to fix it

Upgrade Ghostscript to a build containing commit df8f4966577fff70320be2eb33cb55eb15d05d52 (equivalent to version 10.04.0 or later). Rebuild and redeploy any downstream packages or containers that embed Ghostscript. Where immediate patching is impossible, restrict Ghostscript invocation to trusted input sources only.

How to confirm the fix worked

Confirm the installed Ghostscript binary reports version 10.04.0 or newer, or verify the source tree contains commit df8f4966577fff70320be2eb33cb55eb15d05d52. Re-test with known filenameforall edge-case inputs to ensure the out-of-bounds condition no longer occurs.

Typical attack path

1. Deliver a malicious PostScript/PDF/EPS file to a target that invokes Ghostscript (email attachment, web upload, print spooler, document converter).
2. Ghostscript parses the file and reaches the filenameforall operator with attacker-controlled parameters.
3. Out-of-bounds access occurs during internal file-name enumeration, corrupting memory.
4. Attacker payload in the corrupted memory is executed, granting code execution inside the Ghostscript process.
5. Further actions such as dropping malware, establishing C2, or lateral movement follow from the compromised host.

How to detect it

Review process execution logs, crash dumps, and application error logs for Ghostscript invocations that terminate abnormally or access unexpected files. Correlate with file-creation events following Ghostscript execution and inspect any newly spawned processes or network connections originating from the interpreter.

What your security team should do

• Immediately update all Ghostscript installations and rebuild dependent packages to the fixed commit.
• Inventory every system or container that invokes Ghostscript for document processing and prioritize patching by exposure level.
• Add Ghostscript version checks to build pipelines and container scanning tools.
• Monitor for new public exploits and raise EPSS-based alerting thresholds once exploit maturity increases.