{"id":"CVE-2020-36773","aliases":["DEBIAN-CVE-2020-36773","EUVD-2020-24214","GHSA-mwx2-8cmg-6vmj","OESA-2024-1462","OESA-2024-1463","SUSE-SU-2024:0920-1","SUSE-SU-2024:0921-1","UBUNTU-CVE-2020-36773"],"status":"published","title":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector...","description":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00879,"percentile":0.59329,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416","CWE-787"],"published":"2024-02-04T00:00:00Z","modified":"2026-10-26T12:02:30Z","fixes":[{"ecosystem":"Debian:12","package":"ghostscript","fixed_in":["9.53.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ghostscript","fixed_in":["9.53.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["9.53.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"ghostscript","fixed_in":["9.52-11.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"ghostscript","fixed_in":["9.52-13.oe2003sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"ghostscript","fixed_in":["9.52-150000.185.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"ghostscript","fixed_in":["9.52-150000.185.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ghostscript","fixed_in":["9.52-23.71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ghostscript","fixed_in":["9.52-23.71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ghostscript","fixed_in":["9.52-23.71.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.53.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.53.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.53.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-11.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-13.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.185.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.185.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-23.71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-23.71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-23.71.1"}]}]}],"products":[{"vendor":"artifex","product":"ghostscript"}],"references":[{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=702229","tags":["x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=8c7bd787defa071c96289b7da9397f673fddb874","tags":["x_transferred","Broken Link","web"]},{"url":"https://bugzilla.opensuse.org/show_bug.cgi?id=1177922","tags":["x_transferred","Issue Tracking","report"]},{"url":"https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs9530","tags":["x_transferred","Release Notes","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36773","tags":["advisory"]},{"url":"https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=8c7bd787defa071c96289b7da9397f673fddb874"},{"url":"https://github.com/advisories/GHSA-mwx2-8cmg-6vmj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-36773","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1462","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1463","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240920-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219357","tags":["report"]},{"url":"https://bugzilla.suse.com/1219554","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36773","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240921-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-36773","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36773","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-36773","description":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).","status":"published","published":"2024-02-04T00:00:00Z","modified":"2025-05-22T17:29:16.336Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-787","CWE-416"],"updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2020-24214","description":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).","status":"published","published":"2024-02-04T00:00:00Z","modified":"2025-05-22T17:29:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:40.249574Z"}],"ghsa":[{"id":"GHSA-mwx2-8cmg-6vmj","title":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector...","description":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).","status":"published","published":"2024-02-04T18:30:19Z","modified":"2026-03-15T05:04:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:06:38.115187Z"}],"nvd":[{"id":"CVE-2020-36773","description":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).","status":"published","published":"2024-02-04T18:16:00.713Z","modified":"2026-06-17T03:16:11.957Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-416","CWE-787"],"updated_at":"2026-11-02T14:06:47.910346Z"}],"osv":[{"id":"CVE-2020-36773","description":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).","status":"published","published":"2024-02-04T18:16:00.713Z","modified":"2026-10-20T10:54:21.577156501Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"DEBIAN-CVE-2020-36773","description":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).","status":"published","published":"2024-02-04T18:16:00.713Z","modified":"2026-10-26T12:02:30.125978847Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"OESA-2024-1462","title":"ghostscript security update","description":"Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.\r\n\r\nSecurity Fix(es):\r\n\r\nArtifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).(CVE-2020-36773)","status":"published","published":"2024-04-19T11:06:54Z","modified":"2026-08-18T01:18:23.5628197Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1463","title":"ghostscript security update","description":"Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.\r\n\r\nSecurity Fix(es):\r\n\r\nArtifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).(CVE-2020-36773)","status":"published","published":"2024-04-19T11:06:54Z","modified":"2026-08-18T01:18:22.184642302Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2020-36773","description":"Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).","status":"withdrawn","published":"2024-02-04T18:16:00Z","modified":"2025-07-16T07:19:35.46048Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"SUSE-SU-2024:0920-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- Fixed segfaults in gs_heap_free_object() — ref:_00D1igLOd._500Tr4BRgx:ref (bsc#1219357).\n\nPreviously fixed security issue:\n\n- CVE-2020-36773: Fixed out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) (bsc#1219554). \n","status":"published","published":"2024-03-18T10:24:46Z","modified":"2026-02-04T03:57:36.676818Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0921-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\n- Fixed segfaults in gs_heap_free_object() — ref:_00D1igLOd._500Tr4BRgx:ref (bsc#1219357).\n\nPreviously fixed security issue:\n\n- CVE-2020-36773: Fixed out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) (bsc#1219554). \n","status":"published","published":"2024-03-18T10:30:11Z","modified":"2026-02-04T04:11:50.691905Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}