CVE-2018-16509: Ghostscript privilege restoration flaw allows code execution via crafted PostScript

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.8 with public exploit code and a very high EPSS probability make this a serious risk for any environment still running unpatched Ghostscript, even though it is not in CISA KEV.

What it is

Ghostscript before 9.24 incorrectly checks restoration of privilege when handling /invalidaccess exceptions. An attacker who can supply crafted PostScript can abuse this to execute code through the pipe instruction. Because Ghostscript is commonly invoked by document converters and print pipelines, untrusted input reaching it can lead to code execution.

Impact

An attacker gains arbitrary code execution in the context of the process handling the PostScript, which may be a document converter, print spooler or similar service. This can lead to full compromise of that process and, depending on its privileges, the host.

Attack surface

Reached by supplying a crafted PostScript file to a Ghostscript-based processing path; the CVSS vector is local with user interaction required, so the victim or an automated pipeline must open or process the malicious document. No authentication is needed by the attacker, but the attack depends on the target processing attacker-controlled PostScript.

Exploitation

Public exploit code exists (Exploit-DB 45369 and an oss-sec post tagged Exploit), and EPSS is very high at 0.925 (99.8th percentile), though CISA KEV does not list it. No ransomware group usage is documented in the record.

What to do

• Upgrade Ghostscript to 9.24 or later, or apply the vendor patches referenced in the Ghostscript git commits and distribution advisories (Red Hat RHSA-2018:2918/RHSA-2018:3760, Debian DSA-4294, Ubuntu USN-3768-1).
• If immediate patching is not possible, restrict Ghostscript processing of untrusted PostScript/PDF input, for example by disabling or sandboxing the pipe instruction and related file operations.
• Run Ghostscript-based converters and print pipelines with least privilege and in a sandbox or container to limit the impact of code execution.
• Block or strip PostScript input from untrusted sources at mail gateways, upload endpoints and document conversion services until patched.

Detection

• Monitor for Ghostscript processes spawning unexpected child processes or shells, which would indicate abuse of the pipe instruction.
• Alert on Ghostscript crashes or /invalidaccess exception handling anomalies in application logs, which may indicate exploitation attempts.
• Inspect document conversion and print pipelines for PostScript files containing pipe instructions or unusual /invalidaccess handling.
• Use file and process telemetry to detect PostScript files written to disk followed by Ghostscript execution in web or mail processing contexts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.