Integer overflow in pdftops as used in Xpdf 2.01 and earlier xpdf-i and CUPS before 1.1.18 allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements as demonstrated by cups-pdf.