Executive Summary

Artifex Ghostscript versions prior to 10.01.2 incorrectly validate permissions for pipe devices (using %pipe% or | prefixes). An attacker can craft malicious input that bypasses access controls, potentially enabling arbitrary code execution or privilege escalation on systems running vulnerable Ghostscript. No current CISA KEV listing.

---

Authoritative CVE Metadata - CVSS Base Score: 7.8 (HIGH) - Published: 2023-06-25T22:15:21.463 - Last Modified: 2026-08-28T16:16:49.093

Original Description: Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).

"He who knows, does not speak. He who speaks, does not know."

— Lao Tzu