CVE
CVE-2017-8291
- First Reported
- Aug 3, 2026
- Latest Reported
- Aug 3, 2026
CVE Enrichment
- CVSS
- 7.8 HIGH
- EPSS
- 96.97%
- EPSS Percentile
- 99.89%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- cve@mitre.org
- Published
- 27-Apr-2017 08:59
- Last Modified
- 17-Jun-2026 08:26
- EPSS Date
- 2026-10-12
- CWE
- CWE-843
CVSS Vector
CVSS:3.1 AV:L /
AC:L /
PR:N /
UI:R /
S:U /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2022-05-24
- Remediation Due
- 2022-06-14
- Known Ransomware Campaign Use
- Unknown
- Required Action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2017-8291
Affected Products / Versions
- artifex / ghostscript
Version / affected range: * · before (exclusive) 9.21
cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:* - debian / debian_linux
Version / affected range: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* - redhat / enterprise_linux_desktop
Version / affected range: 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* - redhat / enterprise_linux_desktop
Version / affected range: 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* - redhat / enterprise_linux_eus
Version / affected range: 7.3
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:* - redhat / enterprise_linux_eus
Version / affected range: 7.4
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* - redhat / enterprise_linux_eus
Version / affected range: 7.5
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* - redhat / enterprise_linux_eus
Version / affected range: 7.6
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* - redhat / enterprise_linux_eus
Version / affected range: 7.7
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* - redhat / enterprise_linux_server
Version / affected range: 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* - redhat / enterprise_linux_server
Version / affected range: 7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* - redhat / enterprise_linux_server_aus
Version / affected range: 7.3
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* - redhat / enterprise_linux_server_aus
Version / affected range: 7.4
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* - redhat / enterprise_linux_server_aus
Version / affected range: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* - redhat / enterprise_linux_server_aus
Version / affected range: 7.7
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* - redhat / enterprise_linux_server_tus
Version / affected range: 7.3
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* - redhat / enterprise_linux_server_tus
Version / affected range: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* - redhat / enterprise_linux_server_tus
Version / affected range: 7.7
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* - redhat / enterprise_linux_workstation
Version / affected range: 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* - redhat / enterprise_linux_workstation
Version / affected range: 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- The first detected instance of CRAT was distributed via a spear phishing attack using a Hangul document with the file name “Coronavirus Response Emergency Inquiry.Hwp” that exploited the CVE-2017-8291 vulnerability. ASEC Links Xctdoor Campaigns to Earlier CRAT Attacks in Korea
Malware (4)
Threat Actors (3)
MITRE ATT&CK (22)
Products (5)
Tools (1)
Industries (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.