The CCITTFax decoding filter in Ghostscript 8.60 8.61 and possibly other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file that triggers a buffer underflow in the cf_decode_2d function.