CVE-2024-33871

An issue was discovered in Artifex Ghostscript before 10.03.1

High · published July 3, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
72.7
In the wild
Unconfirmed
What it is

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01425 · 72.7th percentile
Published
2024-07-03T00:00Z
EPSS history
Timeline
  • 03 JUL 00:00Z
    An issue was discovered in Artifex Ghostscript before 10.03.1
    cvelistv5