CVE-2025-27831

Ghostscript: Text buffer overflow with long characters

An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doc_common.c.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2025-27830

Ghostscript: Buffer overflow during serialization of DollarBlend in font

An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2025-59799

Artifex Ghostscript: From CVEorg collector

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2025-59798

Artifex Ghostscript: From CVEorg collector

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2025-59800

Artifex Ghostscript: From CVEorg collector

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2024-46954

ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding

An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../ directory traversal.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript Enterprise Linux

CVE-2025-48708

Ghostscript: Ghostscript Argument Sanitization Vulnerability

gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2025-46646

Ghostscript: Mishandling of Overlong UTF-8 Encoding in Artifex Ghostscript's decode_utf8 Function

In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2023-52722

ghostscript: eexec seeds other than the Type 1 standard are allowed while using SAFER mode

An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2020-36773

Ghostscript: out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite)

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2024-29507

ghostscript: stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters

Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2024-29510

ghostscript: format string injection leads to shell command execution (SAFER bypass)

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.

CVSS 3.1 · 6.3 Medium EPSS 28.0% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript Enterprise Linux Rhel Eus

CVE-2024-29511

ghostscript: ghostscript: arbitrary file read/write through Tesseract configuration

Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Artifex

Products

Ghostscript

CVE-2017-9740

ghostscript: Heap-buffer over-read in the xps_decode_font_char_imp function

The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.

CVSS 3.0 · 7.8 High EPSS 1.8% KEV · Not listed

Vendors

Artifex

Products

Ghostscript Ghostxps

CVE-2017-9739

ghostscript: Heap-buffer over-read in the Ins_JMPR function

The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.

CVSS 3.0 · 7.8 High EPSS 2.5% KEV · Not listed

Vendors

Artifex Debian

Products

Ghostscript Ghostxps Debian Linux

CVE-2017-11714

ghostscript: Out of bounds read in igc_reloc_struct_ptr()

psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.

CVSS 3.0 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Artifex Debian

Products

Ghostscript Debian Linux

CVE-2017-9727

ghostscript: Heap-buffer over-read in the gx_ttfReader__Read function

The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.

CVSS 3.0 · 7.8 High EPSS 2.5% KEV · Not listed

Vendors

Artifex Debian

Products

Ghostscript Ghostxps Debian Linux

CVE-2017-9726

ghostscript: Heap-buffer over-read in the Ins_MDRP function

The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.

CVSS 3.0 · 7.8 High EPSS 2.8% KEV · Not listed

Vendors

Artifex Debian

Products

Ghostscript Ghostxps Debian Linux

CVE-2016-8602

ghostscript: check for sufficient params in .sethalftone5

The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.

CVSS 3.0 · 7.8 High EPSS 3.2% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript Enterprise Linux

CVE-2016-10219

ghostscript: Divide-by-zero in the intersect function

The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Artifex

Products

Ghostscript