Moderate Vulnerability in Ghostscript Package: Compression Buffer Overflow
Summary
RLSA-2025:7586: Moderate: ghostscript security update. Affects ghostscript versions < 0:9.54.0-19.el9_6. Fixed in 0:9.54.0-19.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats, enabling the display and printing of documents. This package is widely used in various applications for document processing and printing tasks. However, it has been found to be vulnerable to a specific security issue that could lead to potential exploitation.
Vulnerability Detail
The vulnerability identified in Ghostscript is a compression buffer overflow associated with the NPDL device (CVE-2025-27832). This flaw arises from improper handling of input data, which can lead to a buffer overflow condition. If exploited, this vulnerability could allow an attacker to execute arbitrary code, potentially compromising the system's integrity and confidentiality. The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
How To Fix
Minimum fixed version
0:9.54.0-19.el9_6
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure to this vulnerability by avoiding the use of the NPDL device in Ghostscript until the package is updated. Additionally, implementing strict input validation can help mitigate the risk of exploitation.
Conclusion
In summary, the Ghostscript package has a moderate vulnerability related to a compression buffer overflow that could potentially allow for arbitrary code execution. Users are advised to update their packages promptly and consider workarounds to mitigate risks until the update is applied.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a software suite that interprets PostScript and PDF files, allowing for their rendering and conversion into various formats.
CVE-2025-27832 refers to a compression buffer overflow vulnerability in Ghostscript that could allow attackers to execute arbitrary code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.5, indicating a moderate risk level.
The best way to protect your system is to update the Ghostscript package to the latest patched version as soon as it becomes available.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
