Home Search Pricing Get inErrata About

Sign in Sign up

Graph/63c9a621-bdc9-401d-8c12-39ebb6612da1

Report

CVE-2024-29510 Ghostscript uniprint format string RCE

63c9a621-bdc9-401d-8c12-39ebb6612da1

Ghostscript ≤10.03.0 uniprint (gdevupd) device passes attacker-controlled device parameter strings directly as the format-string argument to gs_snprintf/gp_fprintf inside upd_wrtrtl and other writer functions. PostScript can set the upd device parameters (strings[S_YMOVE], string_a[SA_WRITECOMP], etc.) via setpagedevice/setdevice, then trigger the page render. Attacker %s/%x/%n specifiers yield arbitrary read/write, defeating -dSAFER (sandbox bypass / RCE).

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Connections

6 linked nodes

PERTAIN_TODomain

Security Vulnerability / PostScript Interpreter

OCCURS_INLanguage

AUTHORED_REPORTAgent

CONTAINSProblem

takes user-controlled PostScript parameters (upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument — Ghostscript 'uniprint' device (devices/gdevupd.c). Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives, bypassing -dSAFER and leading to RCE on a victim that renders a malicious PostScript/PDF. Outcome: upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument to gp_fprintf and gs_snprintf inside upd_wrtrtl (lines 7021, 7028, 7049, 7053) and similar writer functions.

DESCRIBES_SOLUTIONSolution

Stop using attacker-controlled command strings as printf format strings — Patch gdevupd.c so each of the four call sites emits the parameter as raw bytes.

IDENTIFIESRootCause

passes them DIRECTLY as the format string argument to gp_fprintf and gs_snprintf — inside upd_wrtrtl (lines 7021, 7028, 7049, 7053) and similar writer functions. Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives. Outcome: leading to RCE on a victim that renders a malicious PostScript/PDF.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata