CVE-2017-8291: Artifex Ghostscript Type Confusion Vulnerability

KEV

Analyzed

AliasesALPINE-CVE-2017-8291SUSE-SU-2017:1153-1SUSE-SU-2017:1322-1+4 more

Published 27-04-2017Last modified 21-10-2025

Vulnerability summary

CVE-2017-8291 is a high (CVSS 7.8) vulnerability in Artifex Ghostscript. It is known to be exploited: CISA lists it, first on 24-05-2022. EPSS estimates a 96.97% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Act nowlisted as exploited

Listed as exploited by CISA (24-05-2022)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

96.97%

0%100%

Critical · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 6 · Related 4

DSA-3838-1 MGASA-2017-0133 OPENSUSE-SU-2024:10783-1 SUSE-SU-2017:1138-1 SUSE-SU-2017:1404-1 USN-3272-1

Timeline

27-04-2017
PublishedVulnerability first disclosed.
24-05-2022
Added to CISA KEVExploitedArtifex Ghostscript Type Confusion Vulnerability
14-06-2022
CISA remediation dueDeadline passedApply updates per vendor instructions.
21-10-2025
Last modifiedVulnerability information updated.

Description

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

CVSS metrics

8 scores · 6 sources · 3 versions

v3.17.8v3.07.3v2.06.8

EPSS trend

Probability

96.97%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 96.97% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 24-05-2022
Federal due date: 14-06-2022

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2017-8291

Public exploits

3 found

referenceUnverified
Exploit Reference (bugzilla.suse.com)
Maturity: unknown
exploit-databaselocallinuxVerified
Ghostscript 9.21 - Type Confusion Arbitrary Command Execution (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
Ghostscript Type Confusion Arbitrary Command Execution
exploit/unix/fileformat/ghostscript_type_confusion
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-843Access of Resource Using Incompatible TypeThe product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat12 products

enterprise_linux_desktop6.0 | 7.0
enterprise_linux_eus7.3 | 7.4 | 7.5 | 7.6 | 7.7
enterprise_linux_server6.0 | 7.0
enterprise_linux_server_aus7.3 | 7.4 | 7.6 | 7.7
enterprise_linux_server_tus7.3 | 7.6 | 7.7

Show all 12

Suse7 products

ghostscript-library&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 8.62-32.46.1
ghostscript-library&distro=SUSE Linux Enterprise Server 11 SP3-LTSS< 8.62-32.46.1
ghostscript-library&distro=SUSE Linux Enterprise Server 11 SP3-TERADATA< 8.62-32.46.1
ghostscript-library&distro=SUSE Linux Enterprise Server 11 SP4< 8.62-32.44.1 | < 8.62-32.46.1
ghostscript-library&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 8.62-32.44.1 | < 8.62-32.46.1

Show all 7

Debian2 products

ghostscript< 9.20~dfsg-3.1 | < 9.05~dfsg-6.3+deb7u6
debian_linuxEOL8.0

Alpine1 product

ghostscript< 9.21-r2 | < 9.21-r0

Artifex1 product

ghostscript< 9.21

Ubuntu1 product

ghostscript< 9.10~dfsg-0ubuntu10.7 | < 9.18~dfsg~0-0ubuntu2.4

6 vendors · 24 products

References

27 links

www.debian.org/security/2017/dsa-3838Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
bugzilla.suse.com/show_bug.cgi?id=1036453X Refsource MISCExploitIssue TrackingThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2017:1230Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
www.securityfocus.com/bid/98476VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.exploit-db.com/exploits/41955/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
openwall.com/lists/oss-security/2017/04/28/2X Refsource MISCMailing ListPatchThird Party Advisory
security.gentoo.org/glsa/201708-06Vendor AdvisoryX Refsource GENTOOThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1446063X Refsource MISCIssue TrackingPatchThird Party AdvisoryVDB EntryREPORT
git.ghostscript.com?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47dX Refsource CONFIRMBroken Link
bugs.ghostscript.com/show_bug.cgi?id=697808X Refsource MISCIssue TrackingThird Party AdvisoryVDB EntryREPORT

Show all 27 references

www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8291Government ResourceUS Government Resource
security.alpinelinux.org/vuln/CVE-2017-8291Advisory
www.suse.com/support/update/announcement/2017/suse-su-20171153-1/Advisory
bugzilla.suse.com/1036453REPORT
www.suse.com/security/cve/CVE-2017-8291WEB
www.suse.com/support/update/announcement/2017/suse-su-20171322-1/Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1230.jsonAdvisory
access.redhat.com/security/cve/CVE-2017-8291REPORT
www.cve.org/CVERecord?id=CVE-2017-8291AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2017-8291Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogARTICLEREPORT
ubuntu.com/security/CVE-2017-8291REPORT
bugs.ghostscript.com/show_bug.cgi?id=697799REPORT
www.openwall.com/lists/oss-security/2017/04/27/10REPORT
ubuntu.com/security/notices/USN-3272-1Advisory
security-tracker.debian.org/tracker/CVE-2017-8291Advisory