CVE-2025-46646
📋 TL;DR
This vulnerability in Artifex Ghostscript involves improper handling of overlong UTF-8 encoding in the decode_utf8 function, which could allow attackers to cause denial of service or potentially execute arbitrary code. It affects systems running Ghostscript versions before 10.05.0. This is an incomplete fix for a previous vulnerability (CVE-2024-46954).
💻 Affected Systems
- Artifex Ghostscript
📦 What is this software?
Ghostscript by Artifex
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities
Likely Case
Denial of service through application crashes or memory corruption
If Mitigated
Limited impact with proper input validation and sandboxing
🎯 Exploit Status
Exploitation requires crafting malicious UTF-8 sequences in document files. No public exploits known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.05.0
Vendor Advisory: https://bugs.ghostscript.com/show_bug.cgi?id=708311
Restart Required: Yes
Instructions:
1. Download Ghostscript 10.05.0 or later from official sources. 2. Stop all Ghostscript services. 3. Install the updated version. 4. Restart services.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict UTF-8 validation on document input before processing with Ghostscript
Sandbox Ghostscript execution
linuxRun Ghostscript in a container or sandbox with limited privileges
docker run --read-only --cap-drop=ALL -v /tmp:/tmp:ro ghostscript
🧯 If You Can't Patch
- Implement strict document type validation and reject files with unusual UTF-8 encoding
- Monitor Ghostscript processes for crashes and implement rate limiting on document processing
🔍 How to Verify
Check if Vulnerable:
Check Ghostscript version: gs --version. If version is below 10.05.0, system is vulnerable.Check Version:
gs --versionVerify Fix Applied:
After patching, verify version is 10.05.0 or higher: gs --version📡 Detection & Monitoring
Log Indicators:
- Ghostscript process crashes
- Memory access violation errors in system logs
- Unusual UTF-8 encoding patterns in document processing logs
Network Indicators:
- Multiple document uploads with similar characteristics
- Unusual spikes in document processing requests
SIEM Query:
source="ghostscript.log" AND (error OR crash OR "segmentation fault")