Critical UNKNOWN READ Vulnerability in Ghostscript
Summary
OSV-2025-173: UNKNOWN READ in chunk_obj_alloc. Affects ghostscript versions >= d30a9b5e2c551e61795a67ce5b4d6aa1c8ad2fb4, < 714ef06bede27cd12bf3c7d3278fa6327d7a81eb. Fixed in 714ef06bede27cd12bf3c7d3278fa6327d7a81eb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. Ghostscript's capabilities include converting files to different formats, printing, and displaying documents. However, like many software packages, it can be susceptible to vulnerabilities that may compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as OSV-2025-173 is an UNKNOWN READ in the chunk_obj_alloc function within Ghostscript. This issue was reported through OSS-Fuzz, indicating a potential crash state that could lead to unauthorized access or manipulation of memory. The crash occurs during the processing of CFF (Compact Font Format) dictionaries, which are essential for rendering fonts in PDF documents. If exploited, this vulnerability could lead to application crashes or potentially allow for arbitrary code execution.
How To Fix
Minimum fixed version
714ef06bede27cd12bf3c7d3278fa6327d7a81eb
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate risks.
Conclusion
The UNKNOWN READ vulnerability in Ghostscript poses a significant risk that could lead to application crashes and potential security breaches. It is crucial for users to update to the patched version to ensure the integrity and security of their applications. Utilizing tools like Vulert can further enhance security monitoring.
See every vulnerability recorded for ghostscript →
FAQ
The UNKNOWN READ vulnerability allows for potential memory access issues that could lead to application crashes or unauthorized memory manipulation.
You can check your version against the introduced and fixed ranges provided in the vulnerability report. Additionally, using tools like Vulert can help monitor for vulnerabilities.
While the primary concern is application crashes, there is a potential risk of data loss if the application fails during critical operations.
If immediate updates are not possible, ensure that your environment is secure and limit the use of Ghostscript until the update can be applied.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software, including this specific issue with Ghostscript.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
