Security readout for executives and security teams
Plain-English summary
Ghostscript versions 9.18 through 9.50 can crash when handling a specially crafted PDF. The documented impact is denial of service, not confirmed data theft or code execution. Organizations should prioritize systems that automatically convert, preview, print, or scan PDFs from outside users.
Executive priority
Patch during the next normal security window, faster for public upload or conversion services. Business risk is service disruption from crafted PDFs, with no provided evidence of active exploitation or data compromise.
Technical view
CVE-2020-16297 is a buffer overflow in FloydSteinbergDitheringC() in contrib/gdevbjca.c. The CVE states a crafted PDF can cause denial of service in Ghostscript 9.18 to 9.50. Upstream fixed it in version 9.51, with Linux vendor advisories publishing security updates.
Likely exposure
Exposure is most likely where Ghostscript processes untrusted PDFs, including document conversion services, print pipelines, preview generators, and server-side upload workflows. Linux systems using distribution Ghostscript packages may also be affected until patched.
Exploitation context
The provided sources support remote denial of service via a crafted PDF. The bundle does not show CISA KEV listing, active exploitation, public exploit maturity, or confirmed code execution. Treat internet-facing PDF processing as higher urgency.
Researcher notes
The affected range and fixed version come from the CVE description. The source bundle lacks CVSS, CWE, and detailed exploitability data. Validate package-level exposure carefully because Linux vendors may backport the upstream fix without changing to 9.51.
Mitigation direction
- Upgrade Ghostscript to 9.51 or a later fixed release.
- Apply vendor Ghostscript security updates from Debian, Ubuntu, or Gentoo where applicable.
- Reduce or isolate automated processing of untrusted PDFs until patched.
- Review vendor guidance for any distribution-specific package names or backported fixes.
Validation and detection
- Inventory Ghostscript versions on servers, desktops, containers, and build images.
- Identify workflows that invoke Ghostscript on uploaded or emailed PDFs.
- Confirm patched package versions through the operating system vendor advisory.
- Check document-processing logs for repeated crashes around PDF conversion or printing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-16297 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugs.ghostscript.com/show_bug.cgi?id=701800CVE reference
- https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=bf72f1a3dd5392ee8291e3b1518a0c2c5dc6ba39CVE reference
- [debian-lts-announce] 20200820 [SECURITY] [DLA 2335-1] ghostscript security updateCVE reference · mailing-list
- DSA-4748CVE reference · vendor-advisory
- GLSA-202008-20CVE reference · vendor-advisory
- USN-4469-1CVE reference · vendor-advisory
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=bf72f1a3dd5392ee8291e3b1518a0c2c5dc6ba39CVE reference
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/tree/contrib/gdevbjca.c?h=ghostpdl-9.18#n659CVE reference
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=bf72f1a3dd5392ee8291e3b1518a0c2c5dc6ba39CVE reference · x_refsource_MISC, x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.