CVE-2025-27831

Summary: CVE-2025-27831 affects Ghostscript prior to 10.05.0, with a text buffer/Unicode decoding overrun in the DOCXWRITE TXTWRITE device (vector/doc_common.c). The vulnerability is confirmed by multiple connected sources (e.g., Debian security advisories and vendor advisories) referencing the s...

CVE-2025-27836

CVE-2025-27836 affects Ghostscript prior to 10.05.0, with a print buffer overflow in the BJ10V device (contrib/japanese/gdev10v.c). The issue is confirmed in multiple advisories, and a fix was deployed as part of ghostpdl-10.05.0. Connected documents indicate the vulnerability arises from imprope...

CVE-2025-27830

Ghostscript vulnerability CVE-2025-27830: a buffer overflow occurs when serializing DollarBlend in fonts, tracked to base/write_t1.c and psi/zfapi.c, in affected Ghostscript releases prior to 10.05.0. Exploitation could lead to denial of service and potentially arbitrary code execution if malform...

CVE-2018-16513

CVE-2018-16513 affects Artifex Ghostscript prior to 9.24. A crafted PostScript file can trigger a type confusion in the setcolor function, potentially crashing the Ghostscript interpreter or causing unspecified other impact. Mitigation documented across multiple sources is to upgrade Ghostscript ...

CVE-2024-46953

CVE-2024-46953 concerns Ghostscript before 10.04.0, where an integer overflow while parsing the output filename format string in base/gsdevice.c can cause path truncation, enabling path traversal and potential code execution. Affected: Ghostscript PS/PDF interpreter, notably ghostpdl-10.04.0 and ...

CVE-2025-27837

CVE-2025-27837 affects Artifex Ghostscript prior to 10.05.0. A vulnerability in path handling allows access to arbitrary files via a truncated path containing invalid UTF-8 characters in base/gp_mswin.c and base/winrtsup.cpp. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a CRIT...

CVE-2017-9835

The CVE-2017-9835 entry refers to Ghostscript 9.21, where the gs_alloc_ref_array path in psi/ialloc.c can be abused via crafted PostScript due to a missing integer overflow check in base/gsalloc.c, causing a heap-based buffer overflow and application crash (remote/denial of service). The connecte...

CVE-2020-21710

CVE-2020-21710 is a divide-by-zero in Ghostscript 9.50’s eps_print_page (gdevepsn.c) that enables a remote attacker to cause a denial of service by opening a crafted PDF. The vulnerability is acknowledged and mitigated in vendor advisories: Red Hat RHSA-2024:2966, AlmaLinux ALSA-2024:2966, and ot...

CVE-2025-48708

The CVE-2025-48708 entry is confirmed to affect Artifex Ghostscript and is not a placeholder. The issue is in gs_lib_ctx_stash_sanitized_arg (base/gslibctx.c) before 10.05.1, where argument sanitization for the # case is missing, allowing a created PDF to include its password in cleartext. Affect...

CVE-2016-10219

CVE-2016-10219 is tied to Ghostscript 9.20, where the intersect function in base/gxfill.c can be triggered by a crafted PostScript/PDF document to cause a remote denial of service and application crash via a divide-by-zero error. The linked connected documents corroborate the issue in Ghostscript...

CVE-2025-27833

CVE-2025-27833 affects Artifex Ghostscript prior to 10.05.0. A buffer overflow occurs when processing a long TTF font name in pdf/pdf_fmap.c. The CVSS metrics (LOCAL exploit, user interaction required, high impact on confidentiality, integrity, availability) are documented. Remediation is to upgr...

CVE-2017-9611

CVE-2017-9611 – Ghostscript GhostXPS 9.21 is affected. The vulnerability is in the Ins_MIRP function of base/ttinterp.c within Artifex Ghostscript GhostXPS 9.21, which allows remote attackers to cause a denial of service via a crafted document. The impact described is a heap-based buffer over-rea...

CVE-2024-29506

Artifex Ghostscript is affected by CVE-2024-29506: Ghostscript before 10.03.0 contains a stack-based buffer overflow in pdfi_apply_filter() triggered by a long PDF filter name. Impact, per available references, includes potential memory corruption with high-severity risk; exploitation details are...

CVE-2024-46954

Ghostscript before 10.05.0 is affected by decode_utf8() in base/gp_utf8.c mishandling of overlong UTF-8 encoding, enabling a potential directory traversal (CVE-2024-46954). Connected advisories corroborate the issue exists across multiple Linux distributions and note the fix requires upgrading Gh...

CVE-2016-7977

Ghostscript before 9.21 could bypass SAFER mode using the .libfile operator in crafted PostScript, allowing reading arbitrary files. This CVE (CVE-2016-7977) affects Ghostscript up to version 9.20/9.21; remediation is to upgrade to Ghostscript 9.21 or newer where fixed. Related entries note simil...

CVE-2017-11714

CVE-2017-11714 is a vulnerability in Artifex Ghostscript 9.21 where psi/ztoken.c mishandles references to the scanner state structure, allowing a remote attacker to trigger a denial of service (application crash) or potentially other impact via a crafted PostScript document. The root cause involv...

CVE-2024-46952

CVE-2024-46952 affects Artifex Ghostscript before 10.04.0. The issue is a buffer overflow in the PDF processing path, specifically in pdf/pdf_xref.c during handling of a PDF XRef stream (related to W array values). The vulnerability is triggered when processing certain PDF cross-reference streams...

CVE-2016-10220

CVE-2016-10220 affects Artifex Ghostscript, specifically Ghostscript 9.20. The vulnerability is in the function gs_makewordimagedevice (base/gsdevmem.c) and can be triggered by a crafted PDF in the PDF Transparency module, leading to a NULL pointer dereference and an application crash (denial of ...

CVE-2016-8602

The CVE-2016-8602 issue affects Ghostscript before 9.21, where the .sethalftone5 function (psi/zht2.c) can be triggered by a crafted PostScript document with an empty operand stack. This could lead to a denial of service (application crash) and, in the worst case, arbitrary code execution. Affect...

CVE-2020-36773

Summary: CVE-2020-36773 affects Artifex Ghostscript up to version 9.52.x (before 9.53.0). The flaw is an out-of-bounds write and use‑after‑free in devices/vector/gdevtxtw.c (txtwrite) caused by a single PDF character code mapping to multiple Unicode code points (e.g., ligatures). Impact (per sour...

CVE-2024-46955

CVE-2024-46955 : Ghostscript contains an out-of-bounds read in psi/zcolor.c when reading color in Indexed color space, before version 10.04.0. Impact is a local issue with user interaction required (per CVSS details: AV:L, UI:R, Availability:A:H). The fix is indicated by the ghostpdl-10.04.0 comm...

CVE-2025-27834

CVE-2025-27834 affects Artifex Ghostscript prior to 10.05.0. The issue is a buffer overflow triggered by an oversized Type 4 function in a PDF, specifically in pdf/pdf_func.c. Connected sources corroborate the affected component and the root cause (buffer overflow when processing large Type 4 fun...

CVE-2016-7979

Ghostscript before 9.21 vulnerable to bypassing SAFER mode protection and executing arbitrary code via type confusion in .initialize_dsc_parser. This CVE (CVE-2016-7979) affects Ghostscript up to version prior to 9.21; exploitation would occur through crafted PostScript documents that trigger typ...

CVE-2024-29507

CVE-2024-29507 affects Artifex Ghostscript prior to 10.03.0. The vulnerability is described in multiple sources as a heap-based pointer disclosure observable in a constructed BaseFont name within pdf_base_font_alloc, in addition to the already noted stack-based issues (CIDFSubstPath/CIDFSubstFont...

CVE-2024-29509

CVE-2024-29509 affects Artifex Ghostscript before 10.03.0, where a heap-based overflow occurs when PDFPassword (e.g., for runpdf) contains a embedded NUL byte in the middle. This can lead to corruption or potential code execution as described in public disclosures. The vulnerability is attributed...

CVE-2017-8908

CVE-2017-8908 is a Ghostscript vulnerability (affecting Ghostscript 9.21) where the mark_line_tr function in gxscanc.c can be triggered by a crafted PostScript document to cause an out-of-bounds read and denial of service. Public references in connected docs corroborate the issue as a Ghostscript...

CVE-2016-10218

CVE-2016-10218 is a vulnerability in Artifex Ghostscript (Ghostscript 9.20) where the pdf14_pop_transparency_group function (base/gdevp14.c, PDF Transparency module) can be triggered by a crafted file to cause a NULL pointer dereference and application crash, i.e., a denial of service. This is tr...

CVE-2017-15652

CVE-2017-15652 affects Artifex Ghostscript 9.22. The vulnerability is described as an information disclosure risk: attackers can obtain sensitive information through processing a PostScript file. The affected area includes source code files, functions, executables, and libga usage (imagemagick re...

CVE-2017-7948

CVE-2017-7948 describes an integer overflow in Ghostscript 9.21’s mark_curve function, enabling a crafted PostScript document to trigger an out-of-bounds write and crash the application (denial of service) or potentially other impacts. Public advisories and OpenVAS/Gentoo entries confirm Ghostscr...