TI-2016-08294 Aliases CVE-2016-10218 GHSA-64cw-wmc5-j274

The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency…

LOW 27CWE-476Published 2017-04-03 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.

Why it matters now

EPSS 0.01273 70th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:artifex:ghostscript:9.20:::::::*	9.20	Vulnerable	Artifex

cpe:2.3:a:artifex:ghostscript:9.20:*:*:*:*:*:*:* Versions 9.20 Vulnerable ·Artifex

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 5	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix
Red Hat OpenShift Enterprise 2	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2016-10218
2026-10-03 Alias added: GHSA-64cw-wmc5-j274

References

Exploit 1

https://bugs.ghostscript.com/show_bug.cgi?id=697444

Other 1

http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d621292fb2c8157d9899dcd83fd04dd250e30fe4

TI-2017-05861 Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution… KEVCVSS 3.1HIGH 7.8
TI-2021-02712 Improper input validation in ghostscript CVSS 3.1CRITICAL 9.9
TI-2023-13382 In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential… CVSS 3.1CRITICAL 9.8
TI-2018-11841 An issue was discovered in Artifex Ghostscript before 9.24. CVSS 3.0HIGH 7.8
TI-2024-19474 Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the… CVSS 3.1HIGH 8.8
TI-2020-14200 Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex… CVSS 3.1HIGH 7.8

See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences