Buffer Overflow Vulnerability in Ghostscript - CVE-2025-27835
Summary
CVE-2025-27835: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c. Affects ghostscript versions < 10.05.0. Fixed in 10.05.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The software is integral to many applications that require document manipulation, conversion, and printing. However, it has been found to have a critical vulnerability that can lead to severe security risks.
Vulnerability Detail
An issue was discovered in Artifex Ghostscript before version 10.05.0, where a buffer overflow occurs when converting glyphs to Unicode in the psi/zbfont.c file. This vulnerability can potentially allow an attacker to execute arbitrary code, leading to unauthorized access or system compromise. The flaw arises from improper handling of input data during the glyph conversion process, making it a significant security concern for users of affected versions.
How To Fix
Minimum fixed version
10.05.0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or malicious PostScript files that may exploit this vulnerability until the software is updated. Additionally, consider restricting access to the Ghostscript interpreter in environments where it is not needed.
Conclusion
The CVE-2025-27835 vulnerability in Ghostscript poses a significant risk due to its potential for arbitrary code execution. Users are strongly advised to update to the latest version to mitigate this risk. Awareness and prompt action are crucial in maintaining the security of systems utilizing Ghostscript.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2025-27835 is a buffer overflow vulnerability found in Ghostscript that can lead to arbitrary code execution.
Ghostscript versions before 10.05.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
As a temporary measure, avoid processing untrusted PostScript files and restrict access to the Ghostscript interpreter.
More details can be found in the official CVE database and the related advisories linked to CVE-2025-27835.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
