Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 3 products
TRC analysis shows attackers can exploit CVE-2023-36664 by uploading malicious PDFs to WordPress sites, triggering remote code execution during thumbnail generation. Post-compromise lateral movement within infrastructure demonstrates why runtime segmentation helps contain breach chains. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/ghostscript-cve-2026-39919-pdf-rce-vulnerability
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | artifex | ghostscript | - | - | - |
| OS | debian | debian_linux | 11.0 | - | - |
| OS | debian | debian_linux | 12.0 | - | - |
| OS | fedoraproject | fedora | 37 | - | - |
| OS | fedoraproject | fedora | 38 | - | - |