Cyber Resilience

CVE-2024-46951

High

Published: 10 November 2024

Published
10 November 2024
Modified
03 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-46951 is a high-severity Access of Uninitialized Pointer (CWE-824) vulnerability in Suse Linux Enterprise Server. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 31.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution.

CWE(s)
CWE-824

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Ghostscript vulnerabilities (CVE-2024-46951, CVE-2024-46953, CVE-2024-46956) enable arbitrary code execution via malformed PostScript/PDF files (T1203). CVE-2024-46955 allows application crash via out-of-bounds read (T1499.004).

Affected Assets

artifex
ghostscript
≤ 10.04.0
debian
debian linux
12.0
suse
linux enterprise high performance computing
12.0
suse
linux enterprise server
12
suse
linux enterprise server for sap
12

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References