Buffer Overflow Vulnerability in Ghostscript - CVE-2025-27836
Summary
CVE-2025-27836: An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c. Affects ghostscript versions < 10.05.0. Fixed in 10.05.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The software is essential for applications that require document manipulation, printing, and conversion. However, certain versions of Ghostscript are vulnerable to a buffer overflow issue in the BJ10V device, which can lead to potential exploitation if not addressed.
Vulnerability Detail
CVE-2025-27836 is a buffer overflow vulnerability found in the BJ10V device of Ghostscript prior to version 10.05.0. This vulnerability arises from improper handling of print buffers in the code, specifically in the file contrib/japanese/gdev10v.c. If exploited, it could allow an attacker to execute arbitrary code, potentially compromising the system running the affected version of Ghostscript.
How To Fix
Minimum fixed version
10.05.0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the BJ10V device for printing until the software is updated. Additionally, restricting access to the Ghostscript application can help mitigate the risk of exploitation.
Conclusion
CVE-2025-27836 represents a significant security risk for users of Ghostscript prior to version 10.05.0. It is crucial for users to update their installations to the latest version to mitigate the risk of exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2025-27836 is a buffer overflow vulnerability in Ghostscript that can lead to arbitrary code execution.
Versions of Ghostscript prior to 10.05.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, avoid using the BJ10V device for printing and restrict access to the application.
More information can be found in the official CVE database or by visiting the provided links in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
