CVE-2017-8291
Published: May 24, 2022
Official Description
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
CISA KEV Advisory
Artifex Ghostscript Type Confusion Vulnerability
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
Apply updates per vendor instructions.
Risk Analysis
This vulnerability in Artifex Ghostscript allows for a bypass of its security sandbox, leading to remote command execution. Rated as HIGH severity with a very high EPSS score, this indicates a significant risk of exploitation. Its presence in CISA's KEV confirms it has been actively exploited.
This vulnerability has been actively exploited in the wild and is part of CISA's KEV, indicating confirmed real-world attacks. The nature of the flaw suggests it can be triggered remotely.
It is critical to update Artifex Ghostscript to a patched version immediately. Implement robust input validation and restrict untrusted file processing where possible.
Technical Analysis
CVE-2017-8291 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2017-8291 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2017-8291 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1