ZeroDay Findings
Sign inSign up

Findings

CVE-2017-8291

Artifex Ghostscript Type Confusion Vulnerability

Published Apr 26, 2017 · updated Jun 16, 2026 · artifex ghostscript

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 26, 2017 · Catalog

    Detected

    Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

  2. May 24, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 14, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

Required action

Apply updates per vendor instructions.

CISA due date Jun 14, 2022

Affected

  • cpe artifex/ghostscriptversion unspecified
  • cpe debian/debian linux8.0
  • cpe redhat/enterprise linux desktop6.0
  • cpe redhat/enterprise linux desktop7.0
  • cpe redhat/enterprise linux eus7.3
  • cpe redhat/enterprise linux eus7.4
  • cpe redhat/enterprise linux eus7.5
  • cpe redhat/enterprise linux eus7.6
  • vendor Artifex Ghostscriptversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2017-8291

    Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2017-8291

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2017-8291

    30-day exploitation probability 97.0%

    first.org
  • Exploit DatabasePublic exploit reference41955

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_unix/fileformat/ghostscript_type_confusion

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2017-8291

    Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

    nvd.nist.gov

References