CVE-2024-29510 – Exploiting Ghostscript using format strings

A format string vulnerability, CVE-2024-29510, affecting Ghostscript versions up to 10.03.0, allows bypassing the -dSAFER sandbox to achieve code execution. This vulnerability impacts web applications and services utilizing Ghostscript for document conversion and preview functionalities. Codean Labs discovered this issue as part of a series on Ghostscript vulnerabilities. Ghostscript, a Postscript interpreter and document conversion tool, is commonly used in automated systems handling user-supplied files, often indirectly through tools like ImageMagick and LibreOffice. The -dSAFER sandbox in Ghostscript restricts I/O operations to prevent dangerous activities like command execution. However, the sandbox's limitations can be circumvented, enabling file manipulation and potential remote code execution. Ghostscript supports various output devices and document types, making it highly configurable via command-line parameters. The versatility of Ghostscript, combined with the format string vulnerability, poses a significant security risk, especially when handling untrusted files. Security researchers emphasize the importance of updating Ghostscript to the latest version to mitigate these vulnerabilities.