CyberRota Analysis
AI-GeneratedGhostscript versions prior to 10.08.0 are vulnerable to a heap-based buffer overflow in the JPEG 2000 output adapter, which can be exploited by attackers through specially crafted PDFs containing mismatched subsampling factors in JPEG 2000 images. This vulnerability can lead to memory corruption and potentially allow for arbitrary code execution, posing a critical risk to systems utilizing affected versions. Organizations using Ghostscript, particularly those handling PDF processing or image rendering, should prioritize immediate updates to mitigate this severe threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.