cve/2022/CVE-2022-2085.md

### [CVE-2022-2085](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2085)
![](https://img.shields.io/static/v1?label=Product&message=GhostScript&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20Affects%20in%20Ghostscript%20v9.55.0%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476%20-%20NULL%20Pointer%20Dereference&color=brighgreen)

### Description

A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an init_device_procs defined for the device that uses it as a prototype that depends upon the number of bits per pixel. For bpp > 64, mem_x_device is used and does not have an init_device_procs defined. This flaw allows an attacker to parse a large number of bits (more than 64 bits per pixel), which triggers a NULL pointer dereference flaw, causing an application to crash.

### POC

#### Reference
- https://bugs.ghostscript.com/show_bug.cgi?id=704945

#### Github
- https://github.com/ARPSyndicate/cvemon