Critical Vulnerability in Ghostscript: Overlong UTF-8 Encoding Issue
Summary
UBUNTU-CVE-2025-46646: In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. Affects ghostscript versions < 10.02.1~dfsg1-0ubuntu7.6. Fixed in 10.02.1~dfsg1-0ubuntu7.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is essential for applications that require document manipulation and rendering capabilities. However, it has been found to be vulnerable to a specific issue related to UTF-8 encoding, which could lead to potential security risks.
Vulnerability Detail
In Artifex Ghostscript versions prior to 10.05.0, the function decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. This vulnerability arises from an incomplete fix for a previous issue (CVE-2024-46954). If exploited, it could allow attackers to craft malicious inputs that may lead to unexpected behavior or security breaches, potentially compromising the integrity of the system.
How To Fix
Minimum fixed version
10.02.1~dfsg1-0ubuntu7.6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as possible to mitigate risks.
Conclusion
The vulnerability in Ghostscript related to overlong UTF-8 encoding poses significant risks if not addressed. Users are strongly encouraged to update to the latest patched version to ensure their systems remain secure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain software integrity.
See every vulnerability recorded for ghostscript →
FAQ
The CVSS score of this vulnerability is 4.5, indicating a medium severity level.
Ghostscript versions prior to 10.05.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate potential risks.
You can find more details in the Ubuntu Security Notices or the official Ghostscript documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
