CVE-2025-27833
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a...
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
- Record
CVE-2025-27833- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2025-8094
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
- Record
EUVD-2025-8094- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4q6p-vw5p-724c
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a...
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
- Record
GHSA-4q6p-vw5p-724c- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
- Record
CVE-2025-27833- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-27833
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
- Record
ALPINE-CVE-2025-27833- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2025-27833
- Record
BELL-CVE-2025-27833- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSV
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
- Record
CVE-2025-27833- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-27833
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
- Record
DEBIAN-CVE-2025-27833- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1359
ghostscript security update
Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.
Security Fix(es):
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c.(CVE-2025-27830)
An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.(CVE-2025-27832)
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.(CVE-2025-27833)
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.(CVE-2025-27834)
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.(CVE-2025-27835)
An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.(CVE-2025-27836)
- Record
OESA-2025-1359- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-1360
ghostscript security update
Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.
Security Fix(es):
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c.(CVE-2025-27830)
An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.(CVE-2025-27832)
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.(CVE-2025-27833)
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.(CVE-2025-27834)
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.(CVE-2025-27835)
An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.(CVE-2025-27836)
- Record
OESA-2025-1360- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-27833
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.
- Record
UBUNTU-CVE-2025-27833- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2025-0098 No score
Updated ghostscript packages fix security vulnerabilities
This release addresses CVEs: CVE-2025-27835, CVE-2025-27832, CVE-2025-27831, CVE-2025-27836, CVE-2025-27830, CVE-2025-27833, CVE-2025-27837, CVE-2025-27834 The 10.05.0 release deprecates the non-standard operator "selectdevice", all code should now be using the standard "setpagedevice" operator. "selectdevice" will be removed in the 10.06.0 release. We now support production of PDF/X-1a and PDF/X-4a in addition to the existing support for PDF/X-3
- Record
MGASA-2025-0098- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14953-1 No score
ghostscript-10.05.0-1.1 on GA media
These are all security issues fixed in the ghostscript-10.05.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14953-1- Updated
- 2026-11-02
OSVUSN-7378-1 No score
ghostscript vulnerabilities
It was discovered that Ghostscript incorrectly serialized DollarBlend in certain fonts. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-27830)
It was discovered that Ghostscript incorrectly handled the DOCXWRITE TXTWRITE device. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-27831)
It was discovered that Ghostscript incorrectly handled the NPDL device. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-27832)
It was discovered that Ghostscript incorrectly handled certain long TTF file names. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2025-27833)
It was discovered that Ghostscript incorrectly handled oversized Type 4 functions in certain PDF documents. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 24.10. (CVE-2025-27834)
It was discovered that Ghostscript incorrectly handled converting certain glyphs to Unicode. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-27835)
It was discovered that Ghostscript incorrectly handled the BJ10V device. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-27836)
- Record
USN-7378-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ghostscriptAlpine:v3.18 |
before 10.05.0 | 10.05.0 |
ghostscriptAlpine:v3.19 |
before 10.05.0-r0 | 10.05.0-r0 |
ghostscriptAlpine:v3.20 |
before 10.05.0-r0 | 10.05.0-r0 |
ghostscriptAlpine:v3.21 |
before 10.05.0-r0 | 10.05.0-r0 |
ghostscriptAlpine:v3.22 |
before 10.05.0-r0 | 10.05.0-r0 |
ghostscriptAlpine:v3.23 |
before 10.05.0-r0 | 10.05.0-r0 |
ghostscriptAlpine:v3.24 |
before 10.05.0-r0 | 10.05.0-r0 |
ghostscriptAlpaquita:23 |
10.0.0-r0 up to 10.01.2-r4 | 10.01.2-r4 |
ghostscriptAlpaquita:stream |
10.0.0-r0 up to 10.05.0-r0 | 10.05.0-r0 |
ghostscriptDebian:12 |
before 10.0.0~dfsg-11+deb12u7, plus listed versions 10.0.0~dfsg-1110.0.0~dfsg-11+deb12u110.0.0~dfsg-11+deb12u210.0.0~dfsg-11+deb12u310.0.0~dfsg-11+deb12u410.0.0~dfsg-11+deb12u510.0.0~dfsg-11+deb12u6 |
10.0.0~dfsg-11+deb12u7 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ghostscriptDebian:13 |
before 10.05.0~dfsg-1 | 10.05.0~dfsg-1 |
ghostscriptDebian:14 |
before 10.05.0~dfsg-1 | 10.05.0~dfsg-1 |
ghostscriptDebian:12 From an advisory covering 7 CVEs |
before 10.0.0~dfsg-11+deb12u7, plus listed versions 10.0.0~dfsg-1110.0.0~dfsg-11+deb12u110.0.0~dfsg-11+deb12u210.0.0~dfsg-11+deb12u310.0.0~dfsg-11+deb12u410.0.0~dfsg-11+deb12u510.0.0~dfsg-11+deb12u6 |
10.0.0~dfsg-11+deb12u7 |
ghostscriptMageia:9 From an advisory covering 8 CVEs |
before 10.05.0-1.mga9 | 10.05.0-1.mga9 |
ghostscriptopenEuler:24.03-LTS From an advisory covering 6 CVEs |
before 9.56.1-15.oe2403 | 9.56.1-15.oe2403 |
ghostscriptopenEuler:24.03-LTS-SP1 From an advisory covering 6 CVEs |
before 9.56.1-15.oe2403sp1 | 9.56.1-15.oe2403sp1 |
ghostscriptUbuntu:24.04:LTS |
before 10.02.1~dfsg1-0ubuntu7.5, plus listed versions 10.01.2~dfsg1-0ubuntu210.01.2~dfsg1-0ubuntu2.110.02.1~dfsg1-0ubuntu110.02.1~dfsg1-0ubuntu210.02.1~dfsg1-0ubuntu5 Show 5 moreShow less10.02.1~dfsg1-0ubuntu610.02.1~dfsg1-0ubuntu710.02.1~dfsg1-0ubuntu7.110.02.1~dfsg1-0ubuntu7.310.02.1~dfsg1-0ubuntu7.4 |
10.02.1~dfsg1-0ubuntu7.5 |
ghostscriptUbuntu:20.04:LTS From an advisory covering 7 CVEs |
before 9.50~dfsg-5ubuntu4.15, plus listed versions 9.27~dfsg+0-0ubuntu39.27~dfsg+0-0ubuntu49.50~dfsg-5ubuntu19.50~dfsg-5ubuntu29.50~dfsg-5ubuntu3 Show 15 moreShow less9.50~dfsg-5ubuntu49.50~dfsg-5ubuntu4.19.50~dfsg-5ubuntu4.29.50~dfsg-5ubuntu4.39.50~dfsg-5ubuntu4.49.50~dfsg-5ubuntu4.59.50~dfsg-5ubuntu4.69.50~dfsg-5ubuntu4.79.50~dfsg-5ubuntu4.89.50~dfsg-5ubuntu4.99.50~dfsg-5ubuntu4.109.50~dfsg-5ubuntu4.119.50~dfsg-5ubuntu4.129.50~dfsg-5ubuntu4.139.50~dfsg-5ubuntu4.14 |
9.50~dfsg-5ubuntu4.15 |
ghostscriptUbuntu:22.04:LTS From an advisory covering 7 CVEs |
before 9.55.0~dfsg1-0ubuntu5.11, plus listed versions 9.54.0~dfsg1-0ubuntu29.55.0~dfsg1-0ubuntu49.55.0~dfsg1-0ubuntu59.55.0~dfsg1-0ubuntu5.19.55.0~dfsg1-0ubuntu5.2 Show 7 moreShow less9.55.0~dfsg1-0ubuntu5.39.55.0~dfsg1-0ubuntu5.49.55.0~dfsg1-0ubuntu5.59.55.0~dfsg1-0ubuntu5.69.55.0~dfsg1-0ubuntu5.79.55.0~dfsg1-0ubuntu5.99.55.0~dfsg1-0ubuntu5.10 |
9.55.0~dfsg1-0ubuntu5.11 |
ghostscriptUbuntu:24.04:LTS From an advisory covering 7 CVEs |
before 10.02.1~dfsg1-0ubuntu7.5, plus listed versions 10.01.2~dfsg1-0ubuntu210.01.2~dfsg1-0ubuntu2.110.02.1~dfsg1-0ubuntu110.02.1~dfsg1-0ubuntu210.02.1~dfsg1-0ubuntu5 Show 5 moreShow less10.02.1~dfsg1-0ubuntu610.02.1~dfsg1-0ubuntu710.02.1~dfsg1-0ubuntu7.110.02.1~dfsg1-0ubuntu7.310.02.1~dfsg1-0ubuntu7.4 |
10.02.1~dfsg1-0ubuntu7.5 |
ghostscriptopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 10.05.0-1.1 | 10.05.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-27833 is a high vulnerability (CVSS 7.8) in Artifex Ghostscript, published March 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in ghostscript 10.05.0.
References
bugs.ghostscript.com/show_bug.cgi?id=708259
nvd.nist.gov/vuln/detail/CVE-2025-27833
github.com/advisories/GHSA-4q6p-vw5p-724c
security.alpinelinux.org/vuln/CVE-2025-27833
docs.bell-sw.com/security/cves/CVE-2025-27833
security-tracker.debian.org/tracker/CVE-2025-27833
Show 27 moreShow less
advisories.mageia.org/MGASA-2025-0098.html
bugs.mageia.org/show_bug.cgi?id=34088
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1359
ubuntu.com/security/CVE-2025-27833
cve.org/CVERecord?id=CVE-2025-27833
lists.opensuse.org/archives/list/[email protected]/thread/GBB65P3KU5MBN7SLCFPCDEZ3Y2ACRGXP
suse.com/security/cve/CVE-2025-27830