What is CVE-2018-16585?

CVE-2018-16585 is a high-severity vulnerability in Artifex Ghostscript, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2018-09-06.

How severe is CVE-2018-16585?

High severity. CVSS v3 base score is 7.8 out of 10.

Buffer overflow in Artifex Ghostscript

CVE-2018-16585

An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not intended for use during document processing (e.g., after the startup phase). This leads to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. Note: A reputable source believes that the CVE is potentially a duplicate of CVE-2018-15910 as explained in Red Hat bugzilla (https://bugzilla.redhat.com/show_bug.cgi?id=1626193)

Vulnerability class: Buffer Overflow

Published 2018-09-06 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.017 (76.6th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000

Affected products

Artifex Ghostscript
Canonical Ubuntu Linux — versions 14.04, 16.04, 18.04
Debian Linux — versions 8.0, 9.0

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

security.gentoo.org/glsa/201811-12 (vendor-advisory, Third Party Advisory)
usn.ubuntu.com/3768-1/ (vendor-advisory, Third Party Advisory)
git.ghostscript.com/
www.debian.org/security/2018/dsa-4288 (vendor-advisory, Third Party Advisory)
lists.debian.org/debian-lts-announce/2018/09/msg00015.html (mailing-list, Mailing List, Third Party Advisory)
git.ghostscript.com/
seclists.org/oss-sec/2018/q3/182 (Patch, Mailing List, Third Party Advisory)
bugzilla.redhat.com/show_bug.cgi

Frequently asked questions

What is CVE-2018-16585?: CVE-2018-16585 is a high-severity vulnerability in Artifex Ghostscript, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.8/10. Published 2018-09-06.
How severe is CVE-2018-16585?: High severity. CVSS v3 base score is 7.8 out of 10.