← Vulnerability feed

Vulnerability record · CVE-2024-29510 · published 3 July 2024

CVE-2024-29510: Artifex ghostscript vulnerability

Artifex · Ghostscript

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.

6.3 CVSS 3.1 Medium EPSS 28% · top 2.0% CWE-693 · CWE-693
6.3CVSS 3.1 base score
28%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References, 3 tagged exploit
17 Jun 2026Last modified by NVD

Description

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugs.ghostscript.com/show_bug.cgi?id=707662 Issue Tracking
https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ ExploitThird Party Advisory
https://www.openwall.com/lists/oss-security/2024/07/03/7 Mailing List
https://bugs.ghostscript.com/show_bug.cgi?id=707662 Issue Tracking
https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ ExploitThird Party Advisory
https://www.openwall.com/lists/oss-security/2024/07/03/7 Mailing List
https://www.vicarius.io/vsociety/posts/critical-vulnerability-in-ghostscript-cve-2024-29510 ExploitThird Party Advisory

Track CVE-2024-29510 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2017-8291Ghostscript -dSAFER bypass and command execution via type confusionGhostscript through 2017-04-26 contains a type confusion in .rsdparams handling that lets a crafted .eps document bypass the -dSAFER sandbox. A "/Out…KEVEPSS 97%analysed9.9CVE-2021-3781Ghostscript -dSAFER sandbox escape via crafted pipe commandGhostscript's -dSAFER sandbox can be escaped by injecting a specially crafted pipe command, allowing a malicious document to run arbitrary commands a…EPSS 84%analysed9.8CVE-2025-27836Artifex ghostscript classic buffer overflow vulnerabilityAn issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.EPSS 0.59%9.8CVE-2025-27837Artifex ghostscript path traversal vulnerabilityAn issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 charac…EPSS 0.61%9.8CVE-2025-27831Artifex ghostscript classic buffer overflow vulnerabilityAn issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to device…EPSS 0.59%9.8CVE-2025-27832Artifex ghostscript classic buffer overflow vulnerabilityAn issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.EPSS 0.82%9.8CVE-2020-36773Artifex ghostscript use after free vulnerabilityArtifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single characte…EPSS 0.88%9.8CVE-2023-28879Artifex ghostscript out-of-bounds write vulnerabilityIn Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in…EPSS 6.3%

Source: NIST National Vulnerability Database (record CVE-2024-29510), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.