CVE-2018-17961

HIGH

Artifex Ghostscript < 9.25 - Sandbox Protection Bypass via Error Handler Setup

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2018-17961. PoCs published by Google Security Research, matlink.

AI-analyzed exploit summary This exploit leverages a vulnerability in Ghostscript's error handling mechanism to bypass the -dSAFER sandbox and achieve arbitrary file system access. It manipulates the operand stack to expose the `forceput` operator, allowing the attacker to disable security restrictions and modify files like `~/.bashrc`.

Description

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Google Security Research · textlocallinux

https://www.exploit-db.com/exploits/45573

View Code ZIP pw:eip

This exploit leverages a vulnerability in Ghostscript's error handling mechanism to bypass the -dSAFER sandbox and achieve arbitrary file system access. It manipulates the operand stack to expose the `forceput` operator, allowing the attacker to disable security restrictions and modify files like `~/.bashrc`.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Ghostscript (versions up to 9.26)

No auth needed

Prerequisites: Victim must open a malicious PostScript file (e.g., via Evince, ImageMagick, or Nautilus thumbnailer)

MITRE ATT&CK

T1203 - Exploitation for Client Execution T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec STUB 2 stars

by matlink · poc

https://github.com/matlink/CVE-2018-17961

View Code ZIP pw:eip

The repository contains only a README with high-level steps for exploiting CVE-2018-17961 but lacks actual exploit code or technical details. It references a Docker-based setup and an Evince (PDF viewer) exploit via a PostScript file.

Classification

Stub 30%

Attack Type

Rce

Complexity

Moderate

Reliability

Theoretical

Target: Evince (GNOME Document Viewer) versions prior to fix for CVE-2018-17961

No auth needed

Prerequisites: Docker environment · Evince installed in container · PostScript file with exploit payload

MITRE ATT&CK