CVE-2021-45949
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish ...
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
- Record
CVE-2021-45949- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-787, CWE-122
- Updated
- 2026-11-02
CVE List
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
- Record
CVE-2021-45949- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2021-32656
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
- Record
EUVD-2021-32656- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r647-qm87-j9pc
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish ...
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
- Record
GHSA-r647-qm87-j9pc- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-122, CWE-787
- Updated
- 2026-11-02
OSVBELL-CVE-2021-45949
CVE-2021-45949 does not affect BellSoft software
- Record
BELL-CVE-2021-45949- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
- Record
CVE-2021-45949- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVDEBIAN-CVE-2021-45949
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
- Record
DEBIAN-CVE-2021-45949- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2022-1487
ghostscript security update
Ghostscript is an interpreter for PostScript and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.
Security Fix(es):
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).(CVE-2021-45949)
Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp).(CVE-2021-45944)
- Record
OESA-2022-1487- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-45949
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
- Record
UBUNTU-CVE-2021-45949- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVMGASA-2022-0012 No score
Updated ghostscript packages fix security vulnerability
Use-after-free in sampled_data_sample (called from sampled_data_continue and interp). (CVE-2021-45944) Heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp). (CVE-2021-45949)
- Record
MGASA-2022-0012- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0088-1 No score
Security update for ghostscript
This update for ghostscript fixes the following issues:
- CVE-2021-45944: Fixed use-after-free in sampled_data_sample (bsc#1194303)
- CVE-2021-45949: Fixed heap-based buffer overflow in sampled_data_finish (bsc#1194304)
- Record
openSUSE-SU-2022:0088-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11744-1 No score
ghostscript-9.54.0-3.1 on GA media
These are all security issues fixed in the ghostscript-9.54.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11744-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0081-1 No score
Security update for ghostscript
This update for ghostscript fixes the following issues:
- CVE-2021-45944: Fixed use-after-free in sampled_data_sample (bsc#1194303)
- CVE-2021-45949: Fixed heap-based buffer overflow in sampled_data_finish (bsc#1194304)
- Record
SUSE-SU-2022:0081-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0088-1 No score
Security update for ghostscript
This update for ghostscript fixes the following issues:
- CVE-2021-45944: Fixed use-after-free in sampled_data_sample (bsc#1194303)
- CVE-2021-45949: Fixed heap-based buffer overflow in sampled_data_finish (bsc#1194304)
- Record
SUSE-SU-2022:0088-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0088-2 No score
Security update for ghostscript
This update for ghostscript fixes the following issues:
- CVE-2021-45944: Fixed use-after-free in sampled_data_sample (bsc#1194303)
- CVE-2021-45949: Fixed heap-based buffer overflow in sampled_data_finish (bsc#1194304)
- Record
SUSE-SU-2022:0088-2- Updated
- 2026-11-02
OSVSUSE-SU-2022:0088-3 No score
Security update for ghostscript
This update for ghostscript fixes the following issues:
- CVE-2021-45944: Fixed use-after-free in sampled_data_sample (bsc#1194303)
- CVE-2021-45949: Fixed heap-based buffer overflow in sampled_data_finish (bsc#1194304)
- Record
SUSE-SU-2022:0088-3- Updated
- 2026-11-02
OSVUSN-5224-1 No score
ghostscript vulnerabilities
It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-5224-1- Updated
- 2026-11-02
OSVUSN-5224-2 No score
ghostscript vulnerabilities
USN-5224-1 fixed several vulnerabilities in Ghostscript. This update provides the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Ghostscript incorrectly handled certain PostScript files. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could possibly use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-5224-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ghostscriptDebian:12 |
before 9.55.0~dfsg-1 | 9.55.0~dfsg-1 |
ghostscriptDebian:13 |
before 9.55.0~dfsg-1 | 9.55.0~dfsg-1 |
ghostscriptDebian:14 |
before 9.55.0~dfsg-1 | 9.55.0~dfsg-1 |
ghostscriptDebian:9 From an advisory covering 2 CVEs |
before 9.26a~dfsg-0+deb9u8, plus listed versions 9.20~dfsg-3.29.20~dfsg-3.2+deb9u19.20~dfsg-3.2+deb9u29.20~dfsg-3.2+deb9u39.20~dfsg-3.2+deb9u4 Show 30 moreShow less9.20~dfsg-3.2+deb9u59.21~dfsg-19.21~dfsg-1~exp19.22~dfsg-19.22~dfsg-29.22~dfsg-2.19.22~dfsg-2~riscv649.22~dfsg-39.22~~rc1~dfsg-19.24~~rc2~dfsg-19.25~dfsg-0+deb9u19.25~dfsg-19.25~dfsg-1~exp19.25~dfsg-29.25~dfsg-39.25~dfsg-49.25~dfsg-59.25~dfsg-69.25~dfsg-79.26a~dfsg-0+deb9u19.26a~dfsg-0+deb9u29.26a~dfsg-0+deb9u39.26a~dfsg-0+deb9u49.26a~dfsg-0+deb9u59.26a~dfsg-0+deb9u69.26a~dfsg-0+deb9u79.26~dfsg-0+deb9u19.26~dfsg-0+deb9u29.26~dfsg-19.26~dfsg-2 |
9.26a~dfsg-0+deb9u8 |
ghostscriptDebian:10 From an advisory covering 2 CVEs |
before 9.27~dfsg-2+deb10u5, plus listed versions 9.27~dfsg-29.27~dfsg-2+deb10u19.27~dfsg-2+deb10u29.27~dfsg-2+deb10u39.27~dfsg-2+deb10u4 |
9.27~dfsg-2+deb10u5 |
ghostscriptDebian:11 From an advisory covering 2 CVEs |
before 9.53.3~dfsg-7+deb11u2, plus listed versions 9.53.3~dfsg-79.53.3~dfsg-7+deb11u1 |
9.53.3~dfsg-7+deb11u2 |
ghostscriptMageia:8 From an advisory covering 2 CVEs |
before 9.53.3-2.2.mga8 | 9.53.3-2.2.mga8 |
ghostscriptopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 9.52-5.oe1 | 9.52-5.oe1 |
ghostscriptopenEuler:20.03-LTS-SP2 From an advisory covering 2 CVEs |
before 9.52-6.oe1 | 9.52-6.oe1 |
ghostscriptopenEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs |
before 9.52-6.oe1 | 9.52-6.oe1 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ghostscriptSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs |
before 9.52-23.48.1 | 9.52-23.48.1 |
ghostscriptSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 9.52-23.48.1 | 9.52-23.48.1 |
ghostscriptSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 9.52-23.48.1 | 9.52-23.48.1 |
ghostscriptSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptSUSE:Linux Enterprise Real Time 15 SP2 From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptSUSE:Enterprise Storage 6 From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptSUSE:Enterprise Storage 7 From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptUbuntu:Pro:16.04:LTS |
before 9.26~dfsg+0-0ubuntu0.16.04.14+esm1, plus listed versions 9.16~dfsg~0-0ubuntu39.16~dfsg~0-0ubuntu49.18~dfsg~0-0ubuntu19.18~dfsg~0-0ubuntu29.18~dfsg~0-0ubuntu2.2 Show 22 moreShow less9.18~dfsg~0-0ubuntu2.39.18~dfsg~0-0ubuntu2.49.18~dfsg~0-0ubuntu2.69.18~dfsg~0-0ubuntu2.79.18~dfsg~0-0ubuntu2.89.18~dfsg~0-0ubuntu2.99.25~dfsg+1-0ubuntu0.16.04.19.25~dfsg+1-0ubuntu0.16.04.29.25~dfsg+1-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.19.26~dfsg+0-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.49.26~dfsg+0-0ubuntu0.16.04.59.26~dfsg+0-0ubuntu0.16.04.69.26~dfsg+0-0ubuntu0.16.04.79.26~dfsg+0-0ubuntu0.16.04.89.26~dfsg+0-0ubuntu0.16.04.99.26~dfsg+0-0ubuntu0.16.04.109.26~dfsg+0-0ubuntu0.16.04.119.26~dfsg+0-0ubuntu0.16.04.129.26~dfsg+0-0ubuntu0.16.04.139.26~dfsg+0-0ubuntu0.16.04.14 |
9.26~dfsg+0-0ubuntu0.16.04.14+esm1 |
ghostscriptUbuntu:18.04:LTS |
before 9.26~dfsg+0-0ubuntu0.18.04.15, plus listed versions 9.21~dfsg+1-0ubuntu39.22~dfsg+1-0ubuntu19.22~dfsg+1-0ubuntu1.19.22~dfsg+1-0ubuntu1.29.25~dfsg+1-0ubuntu0.18.04.1 Show 14 moreShow less9.25~dfsg+1-0ubuntu0.18.04.29.26~dfsg+0-0ubuntu0.18.04.19.26~dfsg+0-0ubuntu0.18.04.39.26~dfsg+0-0ubuntu0.18.04.49.26~dfsg+0-0ubuntu0.18.04.59.26~dfsg+0-0ubuntu0.18.04.69.26~dfsg+0-0ubuntu0.18.04.79.26~dfsg+0-0ubuntu0.18.04.89.26~dfsg+0-0ubuntu0.18.04.99.26~dfsg+0-0ubuntu0.18.04.109.26~dfsg+0-0ubuntu0.18.04.119.26~dfsg+0-0ubuntu0.18.04.129.26~dfsg+0-0ubuntu0.18.04.139.26~dfsg+0-0ubuntu0.18.04.14 |
9.26~dfsg+0-0ubuntu0.18.04.15 |
ghostscriptUbuntu:20.04:LTS |
before 9.50~dfsg-5ubuntu4.5, plus listed versions 9.27~dfsg+0-0ubuntu39.27~dfsg+0-0ubuntu49.50~dfsg-5ubuntu19.50~dfsg-5ubuntu29.50~dfsg-5ubuntu3 Show 5 moreShow less9.50~dfsg-5ubuntu49.50~dfsg-5ubuntu4.19.50~dfsg-5ubuntu4.29.50~dfsg-5ubuntu4.39.50~dfsg-5ubuntu4.4 |
9.50~dfsg-5ubuntu4.5 |
ghostscriptUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 9.26~dfsg+0-0ubuntu0.18.04.15, plus listed versions 9.21~dfsg+1-0ubuntu39.22~dfsg+1-0ubuntu19.22~dfsg+1-0ubuntu1.19.22~dfsg+1-0ubuntu1.29.25~dfsg+1-0ubuntu0.18.04.1 Show 14 moreShow less9.25~dfsg+1-0ubuntu0.18.04.29.26~dfsg+0-0ubuntu0.18.04.19.26~dfsg+0-0ubuntu0.18.04.39.26~dfsg+0-0ubuntu0.18.04.49.26~dfsg+0-0ubuntu0.18.04.59.26~dfsg+0-0ubuntu0.18.04.69.26~dfsg+0-0ubuntu0.18.04.79.26~dfsg+0-0ubuntu0.18.04.89.26~dfsg+0-0ubuntu0.18.04.99.26~dfsg+0-0ubuntu0.18.04.109.26~dfsg+0-0ubuntu0.18.04.119.26~dfsg+0-0ubuntu0.18.04.129.26~dfsg+0-0ubuntu0.18.04.139.26~dfsg+0-0ubuntu0.18.04.14 |
9.26~dfsg+0-0ubuntu0.18.04.15 |
ghostscriptUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 9.50~dfsg-5ubuntu4.5, plus listed versions 9.27~dfsg+0-0ubuntu39.27~dfsg+0-0ubuntu49.50~dfsg-5ubuntu19.50~dfsg-5ubuntu29.50~dfsg-5ubuntu3 Show 5 moreShow less9.50~dfsg-5ubuntu49.50~dfsg-5ubuntu4.19.50~dfsg-5ubuntu4.29.50~dfsg-5ubuntu4.39.50~dfsg-5ubuntu4.4 |
9.50~dfsg-5ubuntu4.5 |
ghostscriptUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 9.26~dfsg+0-0ubuntu0.16.04.14+esm1, plus listed versions 9.16~dfsg~0-0ubuntu39.16~dfsg~0-0ubuntu49.18~dfsg~0-0ubuntu19.18~dfsg~0-0ubuntu29.18~dfsg~0-0ubuntu2.2 Show 22 moreShow less9.18~dfsg~0-0ubuntu2.39.18~dfsg~0-0ubuntu2.49.18~dfsg~0-0ubuntu2.69.18~dfsg~0-0ubuntu2.79.18~dfsg~0-0ubuntu2.89.18~dfsg~0-0ubuntu2.99.25~dfsg+1-0ubuntu0.16.04.19.25~dfsg+1-0ubuntu0.16.04.29.25~dfsg+1-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.19.26~dfsg+0-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.49.26~dfsg+0-0ubuntu0.16.04.59.26~dfsg+0-0ubuntu0.16.04.69.26~dfsg+0-0ubuntu0.16.04.79.26~dfsg+0-0ubuntu0.16.04.89.26~dfsg+0-0ubuntu0.16.04.99.26~dfsg+0-0ubuntu0.16.04.109.26~dfsg+0-0ubuntu0.16.04.119.26~dfsg+0-0ubuntu0.16.04.129.26~dfsg+0-0ubuntu0.16.04.139.26~dfsg+0-0ubuntu0.16.04.14 |
9.26~dfsg+0-0ubuntu0.16.04.14+esm1 |
htmldocSUSE:Package Hub 12 SP1 From an advisory covering 2 CVEs |
before 1.8.28-9.1 | 1.8.28-9.1 |
ghostscriptopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 9.52-161.1 | 9.52-161.1 |
ghostscriptopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 9.54.0-3.1 | 9.54.0-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-45949 is a medium vulnerability (CVSS 5.5) in Artifex Ghostscript, published December 31, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in ghostscript 9.55.0~dfsg-1.
References
github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675
git.ghostscript.com?p=ghostpdl.git%3Ba=commit%3Bh=2a3129365d3bc0d4a41f107ef175920d1505d1f7
debian.org/security/2022/dsa-5038
lists.debian.org/debian-lts-announce/2022/01/msg00006.html
nvd.nist.gov/vuln/detail/CVE-2021-45949
Show 22 moreShow less
docs.bell-sw.com/security/cves/CVE-2021-45949
security-tracker.debian.org/tracker/CVE-2021-45949
advisories.mageia.org/MGASA-2022-0012.html
bugs.mageia.org/show_bug.cgi?id=29860
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1487
suse.com/support/update/announcement/2022/suse-su-20220081-1
bugzilla.suse.com/1194303
ubuntu.com/security/CVE-2021-45949
cve.org/CVERecord?id=CVE-2021-45949
lists.opensuse.org/archives/list/[email protected]/thread/4UJWNOWSKPBGYUCFFUB7ANJL7A2J2AML