Ghostscript for Windows can be tricked into loading malicious PostScript files from a predictable directory structure that does not exist by default, a flaw that enables local privilege escalation. An authenticated user can create the expected C:\\gs\\ directory path because Windows default ACLs permit directory creation at the root of C:\, and place a crafted PostScript file there. When Ghostscript runs, it automatically loads this resource file, executing its contents with the full privileges of the Ghostscript process. The weakness reflects untrusted search path and unrestricted file system operations (CWE‑426, CWE‑427).

Affected is Artifex Software Ghostscript for Windows versions prior to 10.08.0. The vulnerability exploits files that may appear under C:\\gs\\, a directory structure that is absent by default on Windows installations. Any authenticated local user on the system can exploit the flaw by creating this directory hierarchy and planting a malicious PostScript file, causing privilege escalation when Ghostscript is later executed by any user or service.

The CVSS score of 7 indicates a moderate to high severity of the flaw. EPSS is not available, so actual exploitation probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires only local user authentication and relies on default Windows ACLs, an attacker who has local access can deploy the exploit with relative ease. Successful exploitation results in arbitrary code execution in the context of the Ghostscript process, which typically runs with elevated privileges, thereby providing a strong foothold for further compromise.