Every CVE Search/ Get API key

CVE-2020-36773

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector...

9.8 CriticalFix available

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.88%Up 0.8 points since Feb 8, 2024
90%50%10%1%

What each source reports

NVD Score used 9.8

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

Record
CVE-2020-36773
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416, CWE-787
Updated
2026-11-02
CVE List 9.8

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

Record
CVE-2020-36773
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787, CWE-416
Updated
2026-11-02
EUVDEUVD-2020-24214 9.8

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

Record
EUVD-2020-24214
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mwx2-8cmg-6vmj 9.8

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector...

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

Record
GHSA-mwx2-8cmg-6vmj
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSV 9.8

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

Record
CVE-2020-36773
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-36773 9.8

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

Record
DEBIAN-CVE-2020-36773
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2024-1462 9.8

ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.

Security Fix(es):

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).(CVE-2020-36773)

Record
OESA-2024-1462
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-1463 9.8

ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.

Security Fix(es):

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).(CVE-2020-36773)

Record
OESA-2024-1463
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-36773 9.8

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

Record
UBUNTU-CVE-2020-36773
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVSUSE-SU-2024:0920-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

  • Fixed segfaults in gs_heap_free_object() — ref:_00D1igLOd._500Tr4BRgx:ref (bsc#1219357).

Previously fixed security issue:

  • CVE-2020-36773: Fixed out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) (bsc#1219554).
Record
SUSE-SU-2024:0920-1
Updated
2026-11-02
OSVSUSE-SU-2024:0921-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

  • Fixed segfaults in gs_heap_free_object() — ref:_00D1igLOd._500Tr4BRgx:ref (bsc#1219357).

Previously fixed security issue:

  • CVE-2020-36773: Fixed out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) (bsc#1219554).
Record
SUSE-SU-2024:0921-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ghostscript
Debian:12
 before 9.53.0~dfsg-1
9.53.0~dfsg-1
ghostscript
Debian:13
 before 9.53.0~dfsg-1
9.53.0~dfsg-1
ghostscript
Debian:14
 before 9.53.0~dfsg-1
9.53.0~dfsg-1
ghostscript
openEuler:20.03-LTS-SP1
 before 9.52-11.oe1
9.52-11.oe1
ghostscript
openEuler:20.03-LTS-SP4
 before 9.52-13.oe2003sp4
9.52-13.oe2003sp4
ghostscript
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 9.52-150000.185.1
9.52-150000.185.1
ghostscript
openSUSE:Leap 15.5
 before 9.52-150000.185.1
9.52-150000.185.1
ghostscript
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 9.52-23.71.1
9.52-23.71.1
ghostscript
SUSE:Linux Enterprise Server 12 SP5
 before 9.52-23.71.1
9.52-23.71.1
ghostscript
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 9.52-23.71.1
9.52-23.71.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36773 is a critical vulnerability (CVSS 9.8) in Artifex Ghostscript, published February 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in ghostscript 9.53.0~dfsg-1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open