CVE-2021-3781
A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript...
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Record
CVE-2021-3781- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-20, CWE-78
- Updated
- 2026-11-02
CVE List No score
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Record
CVE-2021-3781- Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2021-27045 No score
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Record
EUVD-2021-27045- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gf7q-r6ff-xwg6
A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript...
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Record
GHSA-gf7q-r6ff-xwg6- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20, CWE-78
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-3781
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Record
ALPINE-CVE-2021-3781- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2021-3781
CVE-2021-3781 does not affect BellSoft software
- Record
BELL-CVE-2021-3781- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSV
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Record
CVE-2021-3781- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-3781
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Record
DEBIAN-CVE-2021-3781- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2022-1560
ghostscript security update
Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.
Security Fix(es):
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2021-3781)
- Record
OESA-2022-1560- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-3781
A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Record
UBUNTU-CVE-2021-3781- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0436 No score
Updated ghostscript packages fix security vulnerability
Trivial -dSAFER bypass in 9.55. (CVE-2021-3781)
- Record
MGASA-2021-0436- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1273-1 No score
Security update for ghostscript
This update for ghostscript fixes the following issues:
Security issue fixed:
- CVE-2021-3781: Fixed a trivial -dSAFER bypass command injection (bsc#1190381)
Also a hardening fix was added:
- Link as position independent executable (bsc#1184123)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:1273-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3044-1 No score
Security update for ghostscript
This update for ghostscript fixes the following issues:
Security issue fixed:
- CVE-2021-3781: Fixed a trivial -dSAFER bypass command injection (bsc#1190381)
Also a hardening fix was added:
- Link as position independent executable (bsc#1184123)
- Record
openSUSE-SU-2021:3044-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10783-1 No score
ghostscript-9.54.0-2.2 on GA media
These are all security issues fixed in the ghostscript-9.54.0-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10783-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3044-1 No score
Security update for ghostscript
This update for ghostscript fixes the following issues:
Security issue fixed:
- CVE-2021-3781: Fixed a trivial -dSAFER bypass command injection (bsc#1190381)
Also a hardening fix was added:
- Link as position independent executable (bsc#1184123)
- Record
SUSE-SU-2021:3044-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3180-1 No score
Security update for ghostscript
This update for ghostscript fixes the following issues:
- CVE-2021-3781: Fixed a trivial -dSAFER bypass command injection (bsc#1190381)
- Record
SUSE-SU-2021:3180-1- Updated
- 2026-11-02
OSVUSN-5075-1 No score
ghostscript vulnerability
It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to access arbitrary files, execute arbitrary code, or cause a denial of service.
- Record
USN-5075-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ghostscriptAlpine:v3.13 |
before 9.53.3-r1 | 9.53.3-r1 |
ghostscriptAlpine:v3.14 |
before 9.54-r1 | 9.54-r1 |
ghostscriptAlpine:v3.15 |
before 9.54-r1 | 9.54-r1 |
ghostscriptAlpine:v3.16 |
before 9.54-r1 | 9.54-r1 |
ghostscriptAlpine:v3.17 |
before 9.54-r1 | 9.54-r1 |
ghostscriptAlpine:v3.18 |
before 9.54-r1 | 9.54-r1 |
ghostscriptAlpine:v3.19 |
before 9.54-r1 | 9.54-r1 |
ghostscriptAlpine:v3.20 |
before 9.54-r1 | 9.54-r1 |
ghostscriptAlpine:v3.21 |
before 9.54-r1 | 9.54-r1 |
ghostscriptAlpine:v3.22 |
before 9.54-r1 | 9.54-r1 |
Show 76 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ghostscriptAlpine:v3.23 |
before 9.54-r1 | 9.54-r1 |
ghostscriptAlpine:v3.24 |
before 9.54-r1 | 9.54-r1 |
ghostscriptDebian:12 |
before 9.53.3~dfsg-8 | 9.53.3~dfsg-8 |
ghostscriptDebian:13 |
before 9.53.3~dfsg-8 | 9.53.3~dfsg-8 |
ghostscriptDebian:14 |
before 9.53.3~dfsg-8 | 9.53.3~dfsg-8 |
ghostscriptDebian:11 |
before 9.53.3~dfsg-7+deb11u1, plus listed versions 9.53.3~dfsg-7 |
9.53.3~dfsg-7+deb11u1 |
ghostscriptMageia:8 |
before 9.53.3-2.1.mga8 | 9.53.3-2.1.mga8 |
ghostscriptopenEuler:20.03-LTS-SP1 |
before 9.52-6.oe1 | 9.52-6.oe1 |
ghostscriptopenEuler:20.03-LTS-SP2 |
before 9.52-7.oe1 | 9.52-7.oe1 |
ghostscriptopenEuler:20.03-LTS-SP3 |
before 9.52-7.oe1 | 9.52-7.oe1 |
ghostscriptSUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 9.52-155.1 | 9.52-155.1 |
ghostscriptSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
libspectreSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Linux Enterprise Server 15-LTSS |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise Server 15-LTSS |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Linux Enterprise Server 15 SP1-BCL |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise Server 15 SP1-BCL |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Linux Enterprise Server for SAP Applications 15 |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise Server for SAP Applications 15 |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Manager Proxy 4.0 |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Manager Proxy 4.0 |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Manager Retail Branch Server 4.0 |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Manager Retail Branch Server 4.0 |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Manager Server 4.0 |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Manager Server 4.0 |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:Enterprise Storage 6 |
before 9.52-155.1 | 9.52-155.1 |
libspectreSUSE:Enterprise Storage 6 |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptSUSE:HPE Helion OpenStack 8 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:HPE Helion OpenStack 8 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:OpenStack Cloud 8 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:OpenStack Cloud 8 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:OpenStack Cloud 9 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:OpenStack Cloud 9 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:OpenStack Cloud Crowbar 8 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:OpenStack Cloud Crowbar 8 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:OpenStack Cloud Crowbar 9 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:OpenStack Cloud Crowbar 9 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:Linux Enterprise Server 12 SP2-BCL |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:Linux Enterprise Server 12 SP2-BCL |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:Linux Enterprise Server 12 SP3-BCL |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:Linux Enterprise Server 12 SP3-BCL |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:Linux Enterprise Server 12 SP5 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:Linux Enterprise Server 12 SP5 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 9.52-23.42.1 | 9.52-23.42.1 |
libspectreSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 0.2.7-12.12.1 | 0.2.7-12.12.1 |
ghostscriptUbuntu:20.04:LTS |
before 9.50~dfsg-5ubuntu4.3, plus listed versions 9.27~dfsg+0-0ubuntu39.27~dfsg+0-0ubuntu49.50~dfsg-5ubuntu19.50~dfsg-5ubuntu29.50~dfsg-5ubuntu39.50~dfsg-5ubuntu49.50~dfsg-5ubuntu4.19.50~dfsg-5ubuntu4.2 |
9.50~dfsg-5ubuntu4.3 |
ghostscriptUbuntu:22.04:LTS |
before 9.54.0~dfsg1-0ubuntu2 | 9.54.0~dfsg1-0ubuntu2 |
ghostscriptopenSUSE:Leap 15.2 |
before 9.52-lp152.2.7.1 | 9.52-lp152.2.7.1 |
ghostscript-miniopenSUSE:Leap 15.2 |
before 9.52-lp152.2.7.1 | 9.52-lp152.2.7.1 |
libspectreopenSUSE:Leap 15.2 |
before 0.2.8-lp152.4.3.1 | 0.2.8-lp152.4.3.1 |
ghostscriptopenSUSE:Leap 15.3 |
before 9.52-155.1 | 9.52-155.1 |
libspectreopenSUSE:Leap 15.3 |
before 0.2.8-3.12.1 | 0.2.8-3.12.1 |
ghostscriptopenSUSE:Tumbleweed From an advisory covering 44 CVEs |
before 9.54.0-2.2 | 9.54.0-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3781 is a critical vulnerability (CVSS 9.9) in Artifex Ghostscript, published September 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 83.9%, the 99th percentile. Fixed in ghostscript 9.53.3-r1.
References
bugzilla.redhat.com/show_bug.cgi?id=2002271
ghostscript.com/CVE-2021-3781.html
security.gentoo.org/glsa/202211-11
nvd.nist.gov/vuln/detail/CVE-2021-3781
github.com/advisories/GHSA-gf7q-r6ff-xwg6
security.alpinelinux.org/vuln/CVE-2021-3781
Show 61 moreShow less
docs.bell-sw.com/security/cves/CVE-2021-3781
security-tracker.debian.org/tracker/CVE-2021-3781
advisories.mageia.org/MGASA-2021-0436.html
bugs.mageia.org/show_bug.cgi?id=29453
ubuntu.com/security/notices/USN-5075-1
debian.org/security/2021/dsa-4972
bugs.ghostscript.com/show_bug.cgi?id=704342
therecord.media/ghostscript-zero-day-allows-full-server-compromises
lists.opensuse.org/archives/list/[email protected]/thread/M64NXCVRRUDYD4U65CYH2ROCOGMSYF3U
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1560
suse.com/support/update/announcement/2021/suse-su-20213044-1
bugzilla.suse.com/1184123
cve.org/CVERecord?id=CVE-2021-3781