Ghostscript zero-day allows full server compromise

Опубликовано: 27 Апрель 2026
на канале: CSI digital

480

Ghostscript zero-day allows full server compromise

Proof-of-concept exploit code was published online over the weekend for an unpatched Ghostscript vulnerability that puts all servers that rely on the component at risk of attacks.

Released back in 1988, Ghostscript is a suite of software based on an interpreter for Adobe Systems’ PostScript and Portable Document Format (PDF) page description languages. Its main purposes are the rasterization or rendering of such page description language files, for the display or printing of document pages, and the conversion between PostScript and PDF files.

Published by Vietnamese security researcher Nguyen The Duc, the proof-of-concept code is available on GitHub and was confirmed to work by several of today’s leading security researchers.

While its primary use is for desktop software, Ghostscript is also used server-side, where it is typically included with image conversion and file upload processing toolkits, such as the popular ImageMagick.

The proof-of-concept code released by Nguyen on Sunday exploits this latter scenario, allowing an attacker to upload a malformed SVG file that escapes the image processing pipeline and runs malicious code on the underlying operating system.

While Nguyen released the public exploit for this bug, he is not the one who discovered the vulnerability.

The person who did is Wunderfund CTO and founder Emil Lerner, who found the bug last year and used it to obtain bug bounties from companies like Airbnb, Dropbox, and Yandex.

Details about the vulnerability leaked into the public domain last month after Lerner held a talk at the ZeroNight X security conference about the current attack vector posed by server-side image conversion tools and used the Ghostscript zero-day as an example.

The researcher told The Record that he was not aware of any patch for the Ghostscript vulnerability prior to Nguyen’s release of the public exploit.

The PoC is written in python and generates payloads to exploit the zero-day in GhostScript 9.50. The flaw could be exploited by an attacker by uploading a malformed SVG file that runs malicious code on the underlying operating system.

“The PoC in python generates payload when exploited for a 0-day of GhostScript 9.50. This 0-day exploit affect to ImageMagick with the default settings from Ubuntu repository (Tested with default settings of ImageMagick on Ubuntu 20.04).” wrote the expert that added that his PoC was created only for educational purposes and cannot be used for law violation or personal gain.

This is the second time the Ghostscript project is in the news because of security issues. In August 2018, a Google security researcher discovered multiple critical vulnerabilities in the Ghostscript library that Artifex failed to patch in time. The company did, however, release fixes two days later after the Ghostscript security issues were broadly exposed.