Every CVE Search/ Get API key

CVE-2025-59800

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer...

4.3 MediumFix available

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.18%Up 0.2 points since Sep 22, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.3

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

Record
CVE-2025-59800
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2025-30396 4.3

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

Record
EUVD-2025-30396
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2mxc-fm8x-qgcp 4.3

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer...

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

Record
GHSA-2mxc-fm8x-qgcp
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-190
Updated
2026-11-02
NVD 4.3

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

Record
CVE-2025-59800
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2025-59800 5.5

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

Record
ALPINE-CVE-2025-59800
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2025-59800 5.5
Record
BELL-CVE-2025-59800
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 11 moreShow less
OSV 5.5

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

Record
CVE-2025-59800
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2025-59800 5.5

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

Record
DEBIAN-CVE-2025-59800
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1222 5.5

ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.

Security Fix(es):

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.(CVE-2025-59798)

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.(CVE-2025-59799)

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.(CVE-2025-59800)

Record
OESA-2026-1222
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1223 5.5

ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.

Security Fix(es):

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.(CVE-2025-59798)

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.(CVE-2025-59799)

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.(CVE-2025-59800)

Record
OESA-2026-1223
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1225 5.5

ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.

Security Fix(es):

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.(CVE-2025-59798)

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.(CVE-2025-59799)

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.(CVE-2025-59800)

Record
OESA-2026-1225
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1226 5.5

ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.

Security Fix(es):

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.(CVE-2025-59798)

Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.(CVE-2025-59799)

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.(CVE-2025-59800)

Record
OESA-2026-1226
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-59800 4.3

In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.

Record
UBUNTU-CVE-2025-59800
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:15707-1 No score

ghostscript-10.06.0-2.1 on GA media

These are all security issues fixed in the ghostscript-10.06.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15707-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20592-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

Update to version 10.06.0.

Security issues fixed:

  • CVE-2025-59800: an integer overflow can lead to a heap-based buffer overflow in ocr_line8 (bsc#1250355).
  • CVE-2025-59799: a large size value can cause a stack-based buffer overflow in pdfmark_coerce_dest (bsc#1250354).
  • CVE-2025-59798: stack-based buffer overflow in pdf_write_cmap can lead to a denial-of-service (bsc#1250353).
  • CVE-2025-48708: lacks of argument sanitization may lead to password disclosure (bsc#1243701).
  • CVE-2025-46646: mishandling of overlong utf-8 encoding in artifex ghostscript's decode_utf8 function (bsc#1257699).

Other updates and bugfixes:

  • switch over to libalternatives for ghostscript to provide a gs variant (bsc#1245896)

  • Version upgrade to 10.06.0:

    • removes the non-standard operator "selectdevice" (cf. the entry below dated Tue Apr 1 09:56:06 UTC 2025)

  • Version upgrade to 10.05.1:

    • an overflow issue in Freetype on platforms where long is a 4 byte (rather than 8 byte) type (Microsoft Windows, for example) causing corrupted glyph rendering at higher resolutions
    • an issue with embedded files, affecting Zugferd format PDF creation.
    • broken logic in PDF Optional Content processing
    • potential slow down due to searching for identifiable font files
    • a small number of extreme edge case segmentation faults.
Record
openSUSE-SU-2026:20592-1
Updated
2026-11-02
OSVSUSE-SU-2026:21363-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

Update to version 10.06.0.

Security issues fixed:

  • CVE-2025-59800: an integer overflow can lead to a heap-based buffer overflow in ocr_line8 (bsc#1250355).
  • CVE-2025-59799: a large size value can cause a stack-based buffer overflow in pdfmark_coerce_dest (bsc#1250354).
  • CVE-2025-59798: stack-based buffer overflow in pdf_write_cmap can lead to a denial-of-service (bsc#1250353).
  • CVE-2025-48708: lacks of argument sanitization may lead to password disclosure (bsc#1243701).
  • CVE-2025-46646: mishandling of overlong utf-8 encoding in artifex ghostscript's decode_utf8 function (bsc#1257699).

Other updates and bugfixes:

  • switch over to libalternatives for ghostscript to provide a gs variant (bsc#1245896)

  • Version upgrade to 10.06.0:

    • removes the non-standard operator "selectdevice" (cf. the entry below dated Tue Apr 1 09:56:06 UTC 2025)

  • Version upgrade to 10.05.1:

    • an overflow issue in Freetype on platforms where long is a 4 byte (rather than 8 byte) type (Microsoft Windows, for example) causing corrupted glyph rendering at higher resolutions
    • an issue with embedded files, affecting Zugferd format PDF creation.
    • broken logic in PDF Optional Content processing
    • potential slow down due to searching for identifiable font files
    • a small number of extreme edge case segmentation faults.
Record
SUSE-SU-2026:21363-1
Updated
2026-11-02
OSVUSN-7782-1 No score

ghostscript vulnerabilities

It was discovered that Ghostscript incorrectly handled opening a file to write. An attacker could possibly use this issue to cause Ghostscript to crash, resulting in a denial of service (CVE-2025-7462)

It was discovered that Ghostscript incorrectly handled writing certain files. An attacker could possibly use this issue to cause Ghostscript to crash, resulting in a denial of service (CVE-2025-59798, CVE-2025-59799)

It was discovered that Ghostscript incorrectly handled performing OCR on certain files. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-59800)

Record
USN-7782-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ghostscript
Alpine:v3.23
 before 10.06.0-r0
10.06.0-r0
ghostscript
Alpine:v3.24
 before 10.06.0-r0
10.06.0-r0
ghostscript
Alpaquita:stream
 10.0.0-r0 up to 10.06.0-r0
10.06.0-r0
ghostscript
Debian:12
 All versions, plus listed versions
10.0.0~dfsg-1110.0.0~dfsg-11+deb12u110.0.0~dfsg-11+deb12u210.0.0~dfsg-11+deb12u310.0.0~dfsg-11+deb12u4
Show 26 moreShow less
10.0.0~dfsg-11+deb12u510.0.0~dfsg-11+deb12u610.0.0~dfsg-11+deb12u710.0.0~dfsg-11+deb12u810.01.2~dfsg-110.02.0~dfsg-110.02.0~dfsg-210.02.1~dfsg-110.02.1~dfsg-210.02.1~dfsg-310.03.0~dfsg-110.03.1~dfsg-110.03.1~dfsg-210.03.1~dfsg~git20240518-110.04.0~dfsg-110.04.0~dfsg-210.05.0~dfsg-110.05.1~dfsg-110.05.1~dfsg-210.05.1~dfsg-310.06.0~dfsg-110.06.0~dfsg-210.06.0~dfsg-310.07.0~dfsg-110.07.0~dfsg-210.07.1~dfsg-1
 None known
ghostscript
Debian:13
 All versions, plus listed versions
10.05.1~dfsg-110.05.1~dfsg-1+deb13u110.05.1~dfsg-210.05.1~dfsg-310.06.0~dfsg-1
Show 5 moreShow less
10.06.0~dfsg-210.06.0~dfsg-310.07.0~dfsg-110.07.0~dfsg-210.07.1~dfsg-1
 None known
ghostscript
Debian:14
 before 10.06.0~dfsg-1, plus listed versions
10.05.1~dfsg-110.05.1~dfsg-210.05.1~dfsg-3
10.06.0~dfsg-1
ghostscript
openEuler:24.03-LTS-SP1
From an advisory covering 3 CVEs
 before 9.56.1-18.oe2403sp1
9.56.1-18.oe2403sp1
ghostscript
openEuler:24.03-LTS-SP2
From an advisory covering 3 CVEs
 before 9.56.1-18.oe2403sp2
9.56.1-18.oe2403sp2
ghostscript
openEuler:22.03-LTS-SP4
From an advisory covering 3 CVEs
 before 9.55.0-22.oe2203sp4
9.55.0-22.oe2203sp4
ghostscript
openEuler:24.03-LTS
From an advisory covering 3 CVEs
 before 9.56.1-18.oe2403
9.56.1-18.oe2403
Show 7 moreShow less
Affected packages
PackageAffectedFixed
ghostscript
Ubuntu:22.04:LTS
 before 9.55.0~dfsg1-0ubuntu5.13, plus listed versions
9.54.0~dfsg1-0ubuntu29.55.0~dfsg1-0ubuntu49.55.0~dfsg1-0ubuntu59.55.0~dfsg1-0ubuntu5.19.55.0~dfsg1-0ubuntu5.2
Show 9 moreShow less
9.55.0~dfsg1-0ubuntu5.39.55.0~dfsg1-0ubuntu5.49.55.0~dfsg1-0ubuntu5.59.55.0~dfsg1-0ubuntu5.69.55.0~dfsg1-0ubuntu5.79.55.0~dfsg1-0ubuntu5.99.55.0~dfsg1-0ubuntu5.109.55.0~dfsg1-0ubuntu5.119.55.0~dfsg1-0ubuntu5.12
9.55.0~dfsg1-0ubuntu5.13
ghostscript
Ubuntu:24.04:LTS
 before 10.02.1~dfsg1-0ubuntu7.8, plus listed versions
10.01.2~dfsg1-0ubuntu210.01.2~dfsg1-0ubuntu2.110.02.1~dfsg1-0ubuntu110.02.1~dfsg1-0ubuntu210.02.1~dfsg1-0ubuntu5
Show 8 moreShow less
10.02.1~dfsg1-0ubuntu610.02.1~dfsg1-0ubuntu710.02.1~dfsg1-0ubuntu7.110.02.1~dfsg1-0ubuntu7.310.02.1~dfsg1-0ubuntu7.410.02.1~dfsg1-0ubuntu7.510.02.1~dfsg1-0ubuntu7.610.02.1~dfsg1-0ubuntu7.7
10.02.1~dfsg1-0ubuntu7.8
ghostscript
Ubuntu:25.10
 before 10.05.0dfsg1-0ubuntu4, plus listed versions
10.05.0dfsg1-0ubuntu110.05.0dfsg1-0ubuntu2
10.05.0dfsg1-0ubuntu4
ghostscript
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 9.55.0~dfsg1-0ubuntu5.13, plus listed versions
9.54.0~dfsg1-0ubuntu29.55.0~dfsg1-0ubuntu49.55.0~dfsg1-0ubuntu59.55.0~dfsg1-0ubuntu5.19.55.0~dfsg1-0ubuntu5.2
Show 9 moreShow less
9.55.0~dfsg1-0ubuntu5.39.55.0~dfsg1-0ubuntu5.49.55.0~dfsg1-0ubuntu5.59.55.0~dfsg1-0ubuntu5.69.55.0~dfsg1-0ubuntu5.79.55.0~dfsg1-0ubuntu5.99.55.0~dfsg1-0ubuntu5.109.55.0~dfsg1-0ubuntu5.119.55.0~dfsg1-0ubuntu5.12
9.55.0~dfsg1-0ubuntu5.13
ghostscript
Ubuntu:24.04:LTS
From an advisory covering 4 CVEs
 before 10.02.1~dfsg1-0ubuntu7.8, plus listed versions
10.01.2~dfsg1-0ubuntu210.01.2~dfsg1-0ubuntu2.110.02.1~dfsg1-0ubuntu110.02.1~dfsg1-0ubuntu210.02.1~dfsg1-0ubuntu5
Show 8 moreShow less
10.02.1~dfsg1-0ubuntu610.02.1~dfsg1-0ubuntu710.02.1~dfsg1-0ubuntu7.110.02.1~dfsg1-0ubuntu7.310.02.1~dfsg1-0ubuntu7.410.02.1~dfsg1-0ubuntu7.510.02.1~dfsg1-0ubuntu7.610.02.1~dfsg1-0ubuntu7.7
10.02.1~dfsg1-0ubuntu7.8
ghostscript
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 10.06.0-2.1
10.06.0-2.1
ghostscript
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 10.06.0-160000.1.1
10.06.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-59800 is a medium vulnerability (CVSS 4.3) in Artifex Ghostscript, published September 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in ghostscript 10.06.0-r0.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open