Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdfbasefont_alloc.
{ "urgency": "not yet assigned" }