Moderate Vulnerability in Ghostscript Package: Compression Buffer Overflow
Summary
RLSA-2025:7593: Moderate: ghostscript security update. Affects ghostscript versions < 0:10.02.1-16.el10_0. Fixed in 0:10.02.1-16.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats, allowing for display and printing. This package is widely used in various applications that require document processing and rendering capabilities. However, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-27832 is a compression buffer overflow in the NPDL device of Ghostscript. This flaw can lead to potential exploitation, allowing attackers to execute arbitrary code or cause a denial of service, thereby impacting the availability of the application. The severity of this vulnerability is rated with a CVSS score of 5.5, indicating a moderate risk level.
How To Fix
Minimum fixed version
0:10.02.1-16.el10_0
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not feasible, consider disabling the NPDL device in Ghostscript configurations to prevent exploitation until a proper update can be applied.
Conclusion
The Ghostscript package has a moderate vulnerability (CVE-2025-27832) that can lead to significant security risks. It is crucial to update to the latest patched version to ensure the security and functionality of applications relying on Ghostscript. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2025-27832 is a vulnerability in the Ghostscript package that involves a compression buffer overflow in the NPDL device.
Exploitation of this vulnerability could allow attackers to execute arbitrary code or cause a denial of service, affecting the application's availability.
You can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
It is recommended to update Ghostscript to the patched version 0:10.02.1-16.el10_0 or later to mitigate the vulnerability.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
