CVE-2025-27835
📋 TL;DR
A buffer overflow vulnerability in Artifex Ghostscript's glyph-to-Unicode conversion function allows attackers to execute arbitrary code or cause denial of service. This affects systems processing untrusted PostScript, PDF, or EPS files through Ghostscript. Users of applications that embed Ghostscript for document rendering are at risk.
💻 Affected Systems
- Artifex Ghostscript
- Applications embedding Ghostscript (e.g., ImageMagick, GIMP, document viewers)
📦 What is this software?
Ghostscript by Artifex
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Ghostscript process, potentially leading to full system compromise.
Likely Case
Application crash or denial of service when processing malicious documents, with potential for limited code execution.
If Mitigated
Denial of service only if exploit attempts are blocked or sandboxed.
🎯 Exploit Status
Exploitation requires processing a malicious document; no authentication needed for the file processing itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.05.0 and later
Vendor Advisory: https://bugs.ghostscript.com/show_bug.cgi?id=708131
Restart Required: No
Instructions:
1. Download Ghostscript 10.05.0+ from artifex.com. 2. Compile and install per platform instructions. 3. For embedded use, update the library in dependent applications.
🔧 Temporary Workarounds
Disable Ghostscript processing
allTemporarily disable Ghostscript in applications (e.g., ImageMagick policy) to block document processing.
For ImageMagick: edit policy.xml to remove PS/PDF/EPS delegates
Sandbox Ghostscript
LinuxRun Ghostscript in a restricted environment (e.g., container, chroot) to limit impact.
Use Docker: docker run --read-only -v /tmp:/tmp ghostscript
🧯 If You Can't Patch
- Restrict file uploads to trusted sources and scan documents with antivirus.
- Monitor for crashes in Ghostscript processes and block offending IPs/files.
🔍 How to Verify
Check if Vulnerable:
Run: gs --version and check if version is below 10.05.0.Check Version:
gs --versionVerify Fix Applied:
Confirm gs --version reports 10.05.0 or higher.📡 Detection & Monitoring
Log Indicators:
- Ghostscript crash logs (segmentation faults)
- Application errors mentioning psi/zbfont.c
Network Indicators:
- Unusual document uploads to web services using Ghostscript
SIEM Query:
source="*ghostscript*" AND ("segmentation fault" OR "buffer overflow")