Cleartext storage of sensitive information in Ghostscript - CVE-2025-48708

Vulnerability identifier: #VU109790

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2025-48708

CWE-ID: CWE-312

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to read PDF documents protected with a password.

The vulnerability exists due to an error within the gs_lib_ctx_stash_sanitized_arg() function in base/gslibctx.c caused by incorrect sanitization of arguments for the # case. As a result, a created PDF document includes its password in cleartext.

Ghostscript
Arch Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Fedora
ghostscript (Ubuntu package)
ghostscript-devel
ghostscript-debuginfo
ghostscript-debugsource
ghostscript-x11
ghostscript
ghostscript-x11-debuginfo
ghostscript-help
ghostscript-tools-dvipdf

Install updates from vendor's website.

Ghostscript - update to 10.05.1
ghostscript (Ubuntu package) - addressed in versions 9.26~dfsg+0-0ubuntu0.16.04.14+esm9, 9.26~dfsg+0-0ubuntu0.18.04.18+esm4, 9.50~dfsg-5ubuntu4.15+esm1, 9.55.0~dfsg1-0ubuntu5.12, 10.02.1~dfsg1-0ubuntu7.7, 10.03.1~dfsg1-0ubuntu2.4, 10.05.0dfsg1-0ubuntu1.1
ghostscript-devel - addressed in versions 9.52-23.92.1, 9.52-150000.206.1
ghostscript-debuginfo - addressed in versions 9.52-23.92.1, 9.52-150000.206.1
ghostscript-debugsource - addressed in versions 9.52-23.92.1, 9.52-150000.206.1
ghostscript-x11 - addressed in versions 9.52-23.92.1, 9.52-150000.206.1
ghostscript - addressed in versions 9.52-23.92.1, 9.52-150000.206.1
ghostscript-x11-debuginfo - addressed in versions 9.52-23.92.1, 9.52-150000.206.1
ghostscript-help - update to 9.56.1-17
ghostscript-tools-dvipdf - update to 9.56.1-17
ghostscript-devel - update to 9.56.1-17
ghostscript-debugsource - update to 9.56.1-17
ghostscript-debuginfo - update to 9.56.1-17
ghostscript - update to 9.56.1-17
ghostscript - addressed in versions 10.03.1-7.fc41, 10.05.1-2.fc42, 10.05.1-2.fc43, 10.05.1-3.fc42
ghostscript - update to 10.05.1-2

• Exploit #11435 - CVE-2025-48708 (May 30, 2025)

• http://www.openwall.com/lists/oss-security/2025/05/23/2
• https://bugs.ghostscript.com/show_bug.cgi?id=708446
• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=b587663c623b4462f9e78686a31fd880207303ee

• Inclusion of cleartext password into protected PDF file in Artifex Ghostscript
• Arch Linux update for ghostscript
• Fedora 43 update for ghostscript
• Fedora 42 update for ghostscript
• Fedora 41 update for ghostscript
• openEuler update for ghostscript
• Fedora 42 update for ghostscript
• Ubuntu update for ghostscript
• SUSE update for ghostscript
• SUSE update for ghostscript