A critical Ghostscript flaw can let crafted PDFs trigger memory corruption and potentially execute code on document-processing servers. GajIPS detects exploitation attempts at the network layer
Severity: Critical | Priority: 1
Ghostscript before 10.08.0 has a heap-based buffer overflow in its JPEG 2000 output adapter. A crafted PDF can trigger it using a JPEG 2000 image whose components declare mismatched subsampling factors. The overflow corrupts internal memory-allocator data and can lead to code execution, and the flaw carries a CVSS base score of 9.8. The risk is highest for servers on your network that process untrusted PDFs with Ghostscript. These include document-upload portals, thumbnail and preview generators, print pipelines, and conversion services built on tools such as ImageMagick.
If an exploit alert is raised for an upload or an inbound email, treat it as an attempted attack on the destination server. Find out whether that server, or anything behind it, processes PDFs with Ghostscript, and check the installed version. If the version is below 10.08.0, assume the file may already have been processed. Isolate the host and look for signs of compromise, such as unexpected child processes from the conversion or rendering service, new files in temporary or web directories, outbound connections from the server, and crashes in the Ghostscript process. Quarantine the PDF or email for analysis rather than deleting it, and block the source IP or sender. Keep the alert set to block on your network until the server is patched.
If an exploit alert is raised for a download, identify the receiving workstation and the website it came from. Most desktop PDF viewers do not use Ghostscript. Still, check whether that user’s system uses Ghostscript for printing, previews, or document conversion. Delete the downloaded file from the endpoint, block the source domain, and run a scan on the workstation.
If an informational alert is raised for a JPEG 2000 PDF upload, it is not an attack by itself. Many legitimate documents contain JPEG 2000 images. Use it to find the servers on your network that receive such files, and confirm whether those servers render them with Ghostscript. If they do, make those servers your patching priority.
In every case, the lasting fix is to upgrade Ghostscript to 10.08.0 or later, or to apply your Linux distribution’s patched package. Debian has a fix for trixie (10.05.1~dfsg-1+deb13u2), while bookworm is still listed as vulnerable. Fixes for Amazon Linux 2 and 2023 are still pending. Until you can patch, run Ghostscript with -dSAFER in a sandboxed, low-privilege account. Also consider rejecting PDFs that contain JPEG 2000 images at your upload services.