CVE-2024-33871: Artifex Ghostscript

High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days.

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.

Affected products

• Artifex Ghostscript: before 10.03.1 (fixed in 10.03.1)

Published 2024-07-03. Last modified 2026-06-17.