Ghostscript Vulnerability Allows for Out-of-Bounds Write and Use-After-Free in PDF Processing

CVE-2020-36773

Summary

Artifex Ghostscript, a widely used software suite for processing PDF and PostScript, contains a vulnerability that allows for an out-of-bounds write and a use-after-free condition. This issue arises from the handling of characters in PDF documents, where a single character can correspond to multiple Unicode code points, such as in the case of ligatures. As a result, this vulnerability can be exploited during the rendering process, leading to potential data corruption and unauthorized access to sensitive information.

References