CVE-2025-59801
📋 TL;DR
A stack-based buffer overflow vulnerability exists in Artifex GhostXPS when processing TIFF files due to insufficient validation of the samplesperpixel value. This could allow an attacker to execute arbitrary code or cause a denial of service by providing a specially crafted TIFF file. Users of GhostXPS versions before 10.06.0 are affected.
💻 Affected Systems
- Artifex GhostXPS
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if exploited successfully.
Likely Case
Application crash (denial of service) when processing malicious TIFF files.
If Mitigated
Limited impact with proper sandboxing and memory protection mechanisms in place.
🎯 Exploit Status
Exploitation requires crafting a malicious TIFF file with manipulated samplesperpixel value to trigger buffer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.06.0 and later
Vendor Advisory: https://bugs.ghostscript.com/show_bug.cgi?id=708819
Restart Required: No
Instructions:
1. Download GhostXPS 10.06.0 or later from official sources
2. Replace existing GhostXPS installation with updated version
3. Verify installation with version check command
🔧 Temporary Workarounds
Restrict TIFF file processing
allBlock or restrict processing of TIFF files through GhostXPS
🧯 If You Can't Patch
- Implement strict input validation for TIFF files before processing
- Run GhostXPS in sandboxed/isolated environment with limited privileges
🔍 How to Verify
Check if Vulnerable:
Check GhostXPS version - if below 10.06.0, system is vulnerableCheck Version:
gxps --versionVerify Fix Applied:
Confirm GhostXPS version is 10.06.0 or higher after update📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing TIFF files
- Memory access violation errors in system logs
Network Indicators:
- Unusual file uploads to systems using GhostXPS
SIEM Query:
search 'GhostXPS crash' OR 'gxps segmentation fault' in application logs