CVE-2018-16585
This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source believes that the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1626193)
- CVSS 3.0
- 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.72% probability · 77th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- artifex/ghostscript · canonical/ubuntu linux · debian/debian linux
- Source
- cve@mitre.org
EPSS moved from 2.8% on 21 September 2026 to 1.7% on 27 October 2026.
References
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=1497d65039885a52b598b137dd8622bd4672f9be
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=971472c83a345a16dac9f90f91258bb22dd77f22
- https://bugzilla.redhat.com/show_bug.cgi?id=1626193
- https://lists.debian.org/debian-lts-announce/2018/09/msg00015.htmlMailing List, Third Party Advisory
- https://seclists.org/oss-sec/2018/q3/182Mailing List, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201811-12Third Party Advisory
- https://usn.ubuntu.com/3768-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4288Third Party Advisory
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=1497d65039885a52b598b137dd8622bd4672f9be
- http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=971472c83a345a16dac9f90f91258bb22dd77f22
- https://bugzilla.redhat.com/show_bug.cgi?id=1626193
- https://lists.debian.org/debian-lts-announce/2018/09/msg00015.htmlMailing List, Third Party Advisory
- https://seclists.org/oss-sec/2018/q3/182Mailing List, Patch, Third Party Advisory
- https://security.gentoo.org/glsa/201811-12Third Party Advisory
- https://usn.ubuntu.com/3768-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4288Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.