Input validation error in Ghostscript - CVE-2025-46646

Vulnerability identifier: #VU108119

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-46646

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of overlong UTF-8 encoding in decode_utf8 in base/gp_utf8.c A remote attacker can pass a specially crafted file to the application and execute arbitrary code on the system.

Note, the vulnerability exists due to incomplete fix for #VU99620 (CVE-2024-46954).

Ghostscript
Gentoo Linux
Anolis OS
Ubuntu
Fedora
ghostscript (Ubuntu package)
libgs10 (Ubuntu package)
ghostscript-tools-printing
ghostscript-doc
libgs-devel
libgs
ghostscript-x11
ghostscript-tools-fonts
ghostscript-tools-dvipdf
ghostscript-gtk
ghostscript
app-text/ghostscript-gpl

Install updates from vendor's website.

Ghostscript - update to 10.05.0
ghostscript (Ubuntu package) - addressed in versions 10.02.1~dfsg1-0ubuntu7.6, 10.03.1~dfsg1-0ubuntu2.3
libgs10 (Ubuntu package) - addressed in versions 10.02.1~dfsg1-0ubuntu7.6, 10.03.1~dfsg1-0ubuntu2.3
ghostscript-tools-printing - update to 10.03.0-8
ghostscript-doc - update to 10.03.0-8
libgs-devel - update to 10.03.0-8
libgs - update to 10.03.0-8
ghostscript-x11 - update to 10.03.0-8
ghostscript-tools-fonts - update to 10.03.0-8
ghostscript-tools-dvipdf - update to 10.03.0-8
ghostscript-gtk - update to 10.03.0-8
ghostscript - update to 10.03.0-8
ghostscript - addressed in versions 10.03.1-6.fc41, 10.05.1-1.fc42, 10.05.1-1.fc43
app-text/ghostscript-gpl - update to 10.05.1

• https://bugs.ghostscript.com/show_bug.cgi?id=708311
• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f14ea81e6c3d2f51593f23cdf13c4679a18f1a3f

• Multiple remote code execution vulnerabilities in Artifex Ghostscript
• Ubuntu update for ghostscript
• Anolis OS update for ghostscript
• Fedora 41 update for ghostscript
• Fedora 43 update for ghostscript
• Fedora 42 update for ghostscript
• Gentoo update for GPL Ghostscript