Overlong UTF-8 Encoding Vulnerability in Ghostscript - CVE-2025-46646
Summary
CVE-2025-46646: In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. Affects ghostscript versions < 10.05.1. Fixed in 10.05.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is essential for applications that require document manipulation, conversion, and printing. However, prior to version 10.05.0, Ghostscript is vulnerable to a specific issue related to UTF-8 encoding, which can lead to security risks if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2025-46646 arises from the mishandling of overlong UTF-8 encoding in the decode_utf8 function located in base/gp_utf8.c. This flaw is a consequence of an incomplete fix for a previous vulnerability (CVE-2024-46954). If exploited, it could allow attackers to craft malicious inputs that may lead to unexpected behavior or security breaches in applications relying on Ghostscript for document processing.
How To Fix
Minimum fixed version
10.05.1
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing documents that may contain overlong UTF-8 encoded characters until the package is updated. Additionally, validating and sanitizing input data before processing can help mitigate potential risks.
Conclusion
CVE-2025-46646 is a significant vulnerability affecting Ghostscript, primarily due to its mishandling of UTF-8 encoding. Users are urged to update to the latest version to mitigate risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2025-46646 is a vulnerability in Ghostscript that involves mishandling overlong UTF-8 encoding, potentially leading to security issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unexpected behavior in applications, including potential security breaches.
Yes, a patch is available in Ghostscript version 10.05.0~dfsg-1 and later.
If an immediate update is not possible, avoid processing documents with potentially malicious UTF-8 encoding and validate all input data.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
