Buffer Overflow Vulnerability in Ghostscript NPDL Device
Summary
CVE-2025-27832: An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c. Affects ghostscript versions < 10.05.0. Fixed in 10.05.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The software is integral to many applications that require document manipulation and conversion. However, prior to version 10.05.0, Ghostscript contained a vulnerability in its NPDL device, which could lead to a buffer overflow, potentially allowing attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability, identified as CVE-2025-27832, originates from a buffer overflow in the NPDL device of Ghostscript versions before 10.05.0. This flaw can be exploited by sending specially crafted input to the device, which may result in memory corruption and could allow an attacker to execute arbitrary code on the affected system. The implications of this vulnerability are severe, as it can lead to unauthorized access and control over the system running the vulnerable version of Ghostscript.
How To Fix
Minimum fixed version
10.05.0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider disabling the NPDL device or restricting access to it until the update can be applied. This can help mitigate the risk of exploitation while you prepare to update the software.
Conclusion
CVE-2025-27832 represents a significant security risk for users of Ghostscript versions prior to 10.05.0. It is crucial to update to the latest version to mitigate this vulnerability and protect your systems from potential exploitation.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2025-27832 is a vulnerability in Ghostscript that allows for a buffer overflow in the NPDL device, potentially leading to arbitrary code execution.
Ghostscript versions prior to 10.05.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, consider disabling the NPDL device or restricting access to it as a temporary workaround.
More information can be found in the CVE database and through security advisories related to Ghostscript.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
