CVE-2022-2085CWE-476

A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory

published June 16, 2022

CVSS
—
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an init_device_procs defined for the device that uses it as a prototype that depends upon the number of bits per pixel. For bpp > 64, mem_x_device is used and does not have an init_device_procs defined. This flaw allows an attacker to parse a large number of bits (more than 64 bits per pixel), which triggers a NULL pointer dereference flaw, causing an application to crash.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01406 · 72.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2022-06-16T00:00Z
EPSS history
Timeline
  • 16 JUN 00:00Z
    A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory
    cvelistv5