Vulnerability record · CVE-2017-8291 · published 27 April 2017
CVE-2017-8291: Ghostscript -dSAFER bypass and command execution via type confusion
Artifex · Ghostscript
Ghostscript through 2017-04-26 contains a type confusion in .rsdparams handling that lets a crafted .eps document bypass the -dSAFER sandbox. A "/OutputFile (%pipe%" substring in the EPS triggers the flaw, allowing remote command execution when the file is processed by gs. It matters because Ghostscript is widely embedded in document conversion and print pipelines, so a malicious document can turn a file-processing step into code execution.
Description
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
critical priorityThe flaw is in CISA KEV with confirmed in-the-wild exploitation, a public exploit, and an EPSS score near 0.97, and it yields command execution through a common document-processing path.
What it is
Ghostscript through 2017-04-26 contains a type confusion in .rsdparams handling that lets a crafted .eps document bypass the -dSAFER sandbox. A "/OutputFile (%pipe%" substring in the EPS triggers the flaw, allowing remote command execution when the file is processed by gs. It matters because Ghostscript is widely embedded in document conversion and print pipelines, so a malicious document can turn a file-processing step into code execution.
Impact
An attacker gains arbitrary command execution in the context of the user or service running Ghostscript, with high impact to confidentiality, integrity and availability. The -dSAFER protection that is meant to contain such documents is defeated.
Attack surface
Reached by supplying a crafted .eps document as input to the gs program; the CVSS vector is local with user interaction required, meaning a victim or automated pipeline must open or process the malicious file. No authentication is needed, but the attacker must get the file into a processing path.
Exploitation
Listed in CISA KEV (added 2022-05-24) and described as exploited in the wild in April 2017, with public exploit references (Exploit-DB 41955, SUSE bug tagged Exploit). EPSS is 0.96968 (99.887th percentile), indicating very high predicted exploitation activity.
What to do
- Apply vendor updates for Ghostscript and the listed Linux distributions (Debian DSA-3838, Red Hat RHSA-2017:1230, Gentoo GLSA 201708-06) and confirm the fixed build is running.
- Where patching is not immediate, disable or restrict Ghostscript processing of untrusted EPS/PS/PDF input, especially in automated conversion and print pipelines.
- Run Ghostscript with the most restrictive sandbox settings available and avoid invoking it with elevated privileges or on shared services.
- Block or quarantine documents containing suspicious "/OutputFile (%pipe%" patterns at mail and file-ingest gateways.
- Inventory all embedded Ghostscript instances (print servers, document converters, image libraries) that may not be covered by OS package updates.
Detection
- Monitor process creation where gs or a Ghostscript-embedding application spawns unexpected child processes such as shells or command interpreters.
- Search file-ingest and mail logs for EPS/PS attachments containing "/OutputFile" and "%pipe%" substrings.
- Alert on Ghostscript crashes or type-confusion related errors in application and system logs.
- Audit hosts for Ghostscript versions older than the vendor-fixed builds and flag unpatched instances.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-8291 to the Known Exploited Vulnerabilities catalog on 24 May 2022 as "Artifex Ghostscript Type Confusion Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 14 June 2022.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-8291 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-8291), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
