CVE-2023-36664: artifex ghostscript
CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2023-36664SUSE-SU-2023:2829-1SUSE-SU-2023:2844-1RHSA-2023:4324RHSA-2023:5459UBUNTU-CVE-2023-36664USN-6213-1DEBIAN-CVE-2023-36664DSA-5446-1CGA-fv7c-8f3f-w97cCGA-qrqj-v4f6-728qopenSUSE-SU-2024:13036-1
Published 25-06-2023Last modified 28-08-2026
Vulnerability summary
CVE-2023-36664 is a high (CVSS 7.8) vulnerability in artifex ghostscript. EPSS estimates a 3.85% chance of exploitation in the next 30 days, higher than 90% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
3.85%
0%100%
Low · -0.39 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 25-06-2023PublishedVulnerability first disclosed.
- 28-08-2026Last modifiedVulnerability information updated.
Description
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSources7 sources · 7.8–8.4
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated8.4HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.85%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
-0.39 pp
From 4.24% on 20-09-2026
20-09-202620-10-2026
EPSS score3.85%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse26 products
- ghostscript&distro=SUSE Enterprise Storage 7< 9.52-150000.167.1
- ghostscript&distro=SUSE Enterprise Storage 7.1< 9.52-150000.167.1
- ghostscript&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 9.52-150000.167.1
- ghostscript&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 9.52-150000.167.1
- ghostscript&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 9.52-150000.167.1
Redhat13 products
- ghostscript< 0:9.54.0-7.el9_0.1 | < 0:9.54.0-10.el9_2
- ghostscript-debuginfo< 0:9.54.0-7.el9_0.1 | < 0:9.54.0-10.el9_2
- ghostscript-debugsource< 0:9.54.0-7.el9_0.1 | < 0:9.54.0-10.el9_2
- ghostscript-doc< 0:9.54.0-7.el9_0.1 | < 0:9.54.0-10.el9_2
- ghostscript-gtk-debuginfo< 0:9.54.0-7.el9_0.1 | < 0:9.54.0-10.el9_2
Opensuse3 products
- ghostscript&distro=openSUSE Leap 15.4< 9.52-150000.167.1
- ghostscript&distro=openSUSE Leap 15.5< 9.52-150000.167.1
- ghostscript&distro=openSUSE Tumbleweed< 9.56.1-4.1
Debian2 products
- ghostscript< 9.53.3~dfsg-7+deb11u5 | < 10.0.0~dfsg-11+deb12u1 | < 10.01.2~dfsg-1
- debian_linuxEOL11.0 | 12.0
Alpine1 product
- ghostscript< 9.55.0-r2 | < 9.56.1-r2
Artifex1 product
- ghostscript< 10.01.2
Chainguard1 product
- ghostscriptAll versions (No fix recorded)
Fedoraproject1 product
- fedoraEOL37 | 38
Ubuntu1 product
- ghostscript< 9.50~dfsg-5ubuntu4.8 | < 9.55.0~dfsg1-0ubuntu5.3
Wolfi1 product
- ghostscriptAll versions (No fix recorded)
10 vendors · 50 products
References
30 links
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 30 references
- git.ghostscript.com?p=ghostpdl.git%3Ba=commit%3Bh=505eab7782b429017eb434b2b95120855f2b0e3cX TransferredWEBPermissions Required
- git.ghostscript.com?p=ghostpdl.git%3Ba=commit%3Bh=0974e4f2ac0005d3731e0b5c13ebc7e965540f4dX TransferredWEBPermissions Required
