CVE-2018-17183 Code injection in n/a

What is CVE-2018-17183?

CVE-2018-17183 is a high-severity code injection vulnerability in Artifex Ghostscript, published on 19 Sep 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code.

Which versions are affected by CVE-2018-17183?

It affects 9 products.

Products include Artifex Ghostscript, Canonical Ubuntu Linux, Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus and 3 more.

How do I fix CVE-2018-17183?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-17183 being exploited?

There is no known exploitation of CVE-2018-17183 in the wild and no public exploit code.

Other vulnerabilities in Artifex Ghostscript

• CVE-2017-8291 Artifex Ghostscript Type Confusion Exploited High 7.8
• CVE-2021-3781 Command injection in ghostscript Critical 9.9
• CVE-2025-27831 Memory corruption in n/a Critical 9.8
• CVE-2025-27832 Memory corruption in n/a Critical 9.8
• CVE-2025-27836 Memory corruption in n/a Critical 9.8

All Artifex Ghostscript vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2018-17183, GHSA-w54c-254g-phcp, UBUNTU-CVE-2018-17183.