CVE-2018-18284

Ghostscript is commonly used to render or convert documents like PDF/PostScript. This bug means a specially crafted document can slip past Ghostscript’s built-in “safety cage” and do things it was meant to prevent when someone opens it. Think of it like a locked room where the lock is supposed to stop wrongdoing—but a clever note can trick the lock during entry.

This matters if your business runs or installs Artifex Ghostscript (including distributions such as Debian/Ubuntu/Red Hat Enterprise Linux) at version 9.25 or earlier and processes PostScript/PDF content from users or other external sources. It’s primarily a risk when a malicious document is opened/handled by Ghostscript, since no login is required but user interaction is involved. Reachability is effectively “yes” in default configurations (so the main gate is whether untrusted document content can reach Ghostscript locally and be opened).

This should be treated as a priority because there is a public exploit and the issue has been getting increasing attention. Even though it requires user interaction (a malicious document being opened), the impact is serious: bypassing Ghostscript’s sandbox can lead to unsafe actions during document processing. Patch on the AMBER urgency track: address it quickly, especially if you handle untrusted documents.

Confirm exposure

1. Identify where Ghostscript is installed and used (desktop apps, servers doing conversion/rendering, email gateways, document management systems).
2. Check the installed Ghostscript version(s). If any are Artifex Ghostscript 9.25 or earlier, you’re within scope.
3. Check whether you process untrusted PostScript/PDF content (uploads, inbound email attachments, shared files from customers/partners).

Upgrade to fixed versions

• If you’re using GPL Ghostscript: upgrade to 9.26 (or later).
• If you’re using Pulse Connect Secure: upgrade to 8.2r12.1 (or later).

Workaround if you can’t patch immediately

• Reduce the chance that malicious documents reach Ghostscript:
  • Do not open unknown/untrusted documents.
  • Block or limit PostScript processing where possible.
  • Prefer rendering/conversion paths that don’t rely on vulnerable Ghostscript for untrusted inputs.

After upgrading

• Verify the service/tool that invokes Ghostscript is actually using the upgraded version.
• Watch for unusual activity around document processing (for example, unexpected behavior triggered by newly received/received attachments), especially on systems that handle user-supplied documents.

Timeline / KEV

• This CVE is not listed in CISA KEV, so there is no specific KEV due date provided here.

This is a sandbox-bypass vulnerability affecting Artifex Ghostscript 9.25 and earlier. The weakness allows attackers to escape the intended restrictions (the “safety cage”) by crafting malicious PostScript that abuses policy handling, including vectors involving the 1Policy operator.

Key points from the findings:

• Attack type: local (triggered during local document processing)
• Authentication: no login required
• User interaction: required (a user must open/trigger processing of malicious content)
• Reachability: stated as true in default configuration
• Exploitation status: a public exploit is available (1 known)
• KEV status: not listed in CISA KEV
• Patch availability: fixed versions exist (Ghostscript 9.26; Pulse Connect Secure 8.2r12.1)

Exploit maturity appears non-trivial due to the presence of a public exploit and reported rising attention. EPSS was provided as a prediction with a rising trend, but public block/decision statements should primarily rely on confirmed public exploit availability and patch availability rather than prediction alone.