{"id":"CVE-2017-8291","url":"https://www.cyber-defence.io/tools/cve/CVE-2017-8291","generatedAt":"2026-10-28T19:48:03.089Z","title":"Artifex Ghostscript Type Confusion Vulnerability","description":"Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a \"/OutputFile (%pipe%\" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.","published":"2017-04-27T01:59:02.000Z","lastModified":"2026-06-17T01:26:08.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-843"],"affected":["artifex/ghostscript","debian/debian linux","redhat/enterprise linux desktop","redhat/enterprise linux eus","redhat/enterprise linux server","redhat/enterprise linux server aus","redhat/enterprise linux server tus","redhat/enterprise linux workstation"],"epss":{"score":0.96968,"percentile":0.99889,"date":"2026-10-27","history":[]},"kev":{"listed":true,"dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Unknown","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-8291"},"exploits":{"count":1,"verified":true,"firstPublished":"2017-05-02","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":41955,"kind":"exploit","title":"Ghostscript 9.21 - Type Confusion Arbitrary Command Execution (Metasploit)","url":"https://www.exploit-db.com/exploits/41955","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/41955.rb","file":"exploits/linux/local/41955.rb","published":"2017-05-02","added":"2017-05-02","updated":"2017-05-02","author":"Metasploit","type":"local","platform":"linux","port":null,"verified":true,"codes":["CVE-2017-8291"],"tags":"Local","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/rapid7/metasploit-framework/blob/03e4ee91c2473775c2a8f28aa36c2023da2854bf/modules/exploits/unix/fileformat/ghostscript_type_confusion.rb"}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 14 June 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://openwall.com/lists/oss-security/2017/04/28/2","tags":["Mailing List","Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.debian.org/security/2017/dsa-3838","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/98476","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://access.redhat.com/errata/RHSA-2017:1230","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=697808","tags":["Issue Tracking","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446063","tags":["Issue Tracking","Patch","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1036453","tags":["Exploit","Issue Tracking","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47d","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/201708-06","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/41955/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://openwall.com/lists/oss-security/2017/04/28/2","tags":["Mailing List","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2017/dsa-3838","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/98476","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2017:1230","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=697808","tags":["Issue Tracking","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1446063","tags":["Issue Tracking","Patch","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1036453","tags":["Exploit","Issue Tracking","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47d","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201708-06","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/41955/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-8291","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-8291","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}