Ghostscript before version 10.08.0 has a bypass of the -dSAFER protection that allows crafted PostScript or PDF files to trigger a type error. The error handling then recovers a privileged .forceput operator via the .putgstringcopy procedure, leading to a use‑after‑free situation across save/restore. This flaw enables an attacker to execute arbitrary code in the Ghostscript process, potentially giving full control of the host system if the interpreter runs with elevated privileges.

All installations of the ArtifexSoftware Ghostscript (ghostpdl) build that are not at least 10.08.0 are susceptible. The vulnerability is present in the gs_fonts.ps script referenced by the product. Users running older releases of Ghostscript for PDF or PostScript rendering must verify their version and update or reconfigure accordingly.

The CVSS score of 8.5 classifies this flaw as high severity. EPSS is not available, so the likelihood of exploitation cannot be quantified, but the lack of a mitigating security feature and the ability to trigger the flaw via user‑supplied content make it a serious threat. The vulnerability is not listed in the CISA KEV catalog as of the last update. Attackers can exploit the flaw by providing maliciously crafted documents that are processed by Ghostscript in an environment where the -dSAFER flag has been set, enabling the bypass of its intended restrictions.