Integer overflow in Ghostscript - CVE-2025-59800

Vulnerability identifier: #VU118563

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-59800

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the ocr_begin_page() function in devices/gdevpdfocr.c. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Ghostscript
openEuler
Ubuntu
Anolis OS
ghostscript (Ubuntu package)
ghostscript
ghostscript-debuginfo
ghostscript-debugsource
ghostscript-devel
ghostscript-tools-dvipdf
ghostscript-help
libgs
ghostscript-x11
ghostscript-tools-printing
ghostscript-tools-fonts
ghostscript-gtk
libgs-devel
ghostscript-doc

Install update from vendor's website.

ghostscript (Ubuntu package) - addressed in versions 9.55.0~dfsg1-0ubuntu5.13, 10.02.1~dfsg1-0ubuntu7.8, 10.05.0dfsg1-0ubuntu1.2
ghostscript - addressed in versions 9.55.0-22, 9.56.1-18
ghostscript-debuginfo - addressed in versions 9.55.0-22, 9.56.1-18
ghostscript-debugsource - addressed in versions 9.55.0-22, 9.56.1-18
ghostscript-devel - addressed in versions 9.55.0-22, 9.56.1-18
ghostscript-tools-dvipdf - addressed in versions 9.55.0-22, 9.56.1-18
ghostscript-help - addressed in versions 9.55.0-22, 9.56.1-18
libgs - update to 10.05.1-4
ghostscript-x11 - update to 10.05.1-4
ghostscript-tools-printing - update to 10.05.1-4
ghostscript-tools-fonts - update to 10.05.1-4
ghostscript-tools-dvipdf - update to 10.05.1-4
ghostscript-gtk - update to 10.05.1-4
ghostscript - update to 10.05.1-4
libgs-devel - update to 10.05.1-4
ghostscript-doc - update to 10.05.1-4

• https://bugs.ghostscript.com/show_bug.cgi?id=708602
• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=176cf0188a2294bc307b8caec876f39412e58350

• Multiple vulnerabilities in Artifex Ghostscript
• Ubuntu update for ghostscript
• Anolis OS update for ghostscript
• openEuler 24.03 LTS update for ghostscript
• openEuler 22.03 LTS SP4 update for ghostscript
• openEuler 24.03 LTS SP2 update for ghostscript
• openEuler 24.03 LTS SP1 update for ghostscript