Heap-buffer-overflow in read_xref in ghostscript

ghostscript Updated 02 Oct 2025

Summary

29/12/2021

Disclosed on

MEDIUM

Severity

Yes i

Fix available

Medium

Severity

Not published

CVSS Score

OSV-2021-1781: Heap-buffer-overflow in read_xref. Affects ghostscript versions >= 75fbddf52051987287e62d13c659eb73ba16982f, < b0855fa22cd6ba447482ee2ae1c5e091428c4bc0. Fixed in b0855fa22cd6ba447482ee2ae1c5e091428c4bc0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and converting PDF files. The vulnerability in question, identified as OSV-2021-1781, is a heap-buffer-overflow issue that affects the read_xref function in Ghostscript. This function is responsible for reading cross-reference tables in PDF files. By exploiting this vulnerability, an attacker could trigger a heap-buffer-overflow read of 8 bytes, potentially leading to a crash or arbitrary code execution.

Vulnerability Detail

The vulnerability originates from a heap-buffer-overflow read in the read_xref function of Ghostscript. This occurs when the function attempts to read more data than is available in the buffer, resulting in a read beyond the allocated memory. An attacker could craft a malicious PDF file that triggers this vulnerability when processed by Ghostscript. The impact of this vulnerability could range from a denial-of-service condition to potential remote code execution, depending on how it is exploited. The vulnerability was discovered through the OSS-Fuzz project, and the affected versions of Ghostscript have been identified. The severity of this vulnerability is classified as MEDIUM.

How To Fix

Minimum fixed version

b0855fa22cd6ba447482ee2ae1c5e091428c4bc0

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

At the moment, there is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above by updating Ghostscript to a patched version.

Conclusion

The heap-buffer-overflow vulnerability in the read_xref function of Ghostscript can potentially lead to a crash or arbitrary code execution. It is crucial to update Ghostscript to a version that includes the fix for this vulnerability. Regularly updating the software is also recommended to address any future vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for ghostscript →