Every CVE Search/ Get API key

CVE-2025-59801

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff...

4.3 MediumFix available

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.20%Up 0.2 points since Sep 22, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.3

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

Record
CVE-2025-59801
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-121
Updated
2026-11-02
EUVDEUVD-2025-30397 4.3

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

Record
EUVD-2025-30397
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-h582-rvj3-8qw3 4.3

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff...

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

Record
GHSA-h582-rvj3-8qw3
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-121
Updated
2026-11-02
NVD 4.3

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

Record
CVE-2025-59801
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness
CWE-121
Updated
2026-11-02
OSVALPINE-CVE-2025-59801 4.3

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

Record
ALPINE-CVE-2025-59801
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-03
OSVDEBIAN-CVE-2025-59801 4.3

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

Record
DEBIAN-CVE-2025-59801
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2025-59801 4.3

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

Record
UBUNTU-CVE-2025-59801
CVSS 3.1
4.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Updated
2026-11-02
OSV No score

In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

Record
CVE-2025-59801
Updated
2026-11-02
OSVopenSUSE-SU-2025:15707-1 No score

ghostscript-10.06.0-2.1 on GA media

These are all security issues fixed in the ghostscript-10.06.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15707-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20592-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

Update to version 10.06.0.

Security issues fixed:

  • CVE-2025-59800: an integer overflow can lead to a heap-based buffer overflow in ocr_line8 (bsc#1250355).
  • CVE-2025-59799: a large size value can cause a stack-based buffer overflow in pdfmark_coerce_dest (bsc#1250354).
  • CVE-2025-59798: stack-based buffer overflow in pdf_write_cmap can lead to a denial-of-service (bsc#1250353).
  • CVE-2025-48708: lacks of argument sanitization may lead to password disclosure (bsc#1243701).
  • CVE-2025-46646: mishandling of overlong utf-8 encoding in artifex ghostscript's decode_utf8 function (bsc#1257699).

Other updates and bugfixes:

  • switch over to libalternatives for ghostscript to provide a gs variant (bsc#1245896)

  • Version upgrade to 10.06.0:

    • removes the non-standard operator "selectdevice" (cf. the entry below dated Tue Apr 1 09:56:06 UTC 2025)

  • Version upgrade to 10.05.1:

    • an overflow issue in Freetype on platforms where long is a 4 byte (rather than 8 byte) type (Microsoft Windows, for example) causing corrupted glyph rendering at higher resolutions
    • an issue with embedded files, affecting Zugferd format PDF creation.
    • broken logic in PDF Optional Content processing
    • potential slow down due to searching for identifiable font files
    • a small number of extreme edge case segmentation faults.
Record
openSUSE-SU-2026:20592-1
Updated
2026-11-02
OSVSUSE-SU-2026:21363-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issues:

Update to version 10.06.0.

Security issues fixed:

  • CVE-2025-59800: an integer overflow can lead to a heap-based buffer overflow in ocr_line8 (bsc#1250355).
  • CVE-2025-59799: a large size value can cause a stack-based buffer overflow in pdfmark_coerce_dest (bsc#1250354).
  • CVE-2025-59798: stack-based buffer overflow in pdf_write_cmap can lead to a denial-of-service (bsc#1250353).
  • CVE-2025-48708: lacks of argument sanitization may lead to password disclosure (bsc#1243701).
  • CVE-2025-46646: mishandling of overlong utf-8 encoding in artifex ghostscript's decode_utf8 function (bsc#1257699).

Other updates and bugfixes:

  • switch over to libalternatives for ghostscript to provide a gs variant (bsc#1245896)

  • Version upgrade to 10.06.0:

    • removes the non-standard operator "selectdevice" (cf. the entry below dated Tue Apr 1 09:56:06 UTC 2025)

  • Version upgrade to 10.05.1:

    • an overflow issue in Freetype on platforms where long is a 4 byte (rather than 8 byte) type (Microsoft Windows, for example) causing corrupted glyph rendering at higher resolutions
    • an issue with embedded files, affecting Zugferd format PDF creation.
    • broken logic in PDF Optional Content processing
    • potential slow down due to searching for identifiable font files
    • a small number of extreme edge case segmentation faults.
Record
SUSE-SU-2026:21363-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ghostscript
Alpine:v3.23
 before 10.06.0-r0
10.06.0-r0
ghostscript
Alpine:v3.24
 before 10.06.0-r0
10.06.0-r0
ghostscript
Debian:12
 All versions, plus listed versions
10.0.0~dfsg-1110.0.0~dfsg-11+deb12u110.0.0~dfsg-11+deb12u210.0.0~dfsg-11+deb12u310.0.0~dfsg-11+deb12u4
Show 28 moreShow less
10.0.0~dfsg-11+deb12u510.0.0~dfsg-11+deb12u610.0.0~dfsg-11+deb12u710.0.0~dfsg-11+deb12u810.01.2~dfsg-110.02.0~dfsg-110.02.0~dfsg-210.02.1~dfsg-110.02.1~dfsg-210.02.1~dfsg-310.03.0~dfsg-110.03.1~dfsg-110.03.1~dfsg-210.03.1~dfsg~git20240518-110.04.0~dfsg-110.04.0~dfsg-210.05.0~dfsg-110.05.1~dfsg-110.05.1~dfsg-210.05.1~dfsg-310.06.0~dfsg-110.06.0~dfsg-210.06.0~dfsg-310.07.0~dfsg-110.07.0~dfsg-210.07.1~dfsg-110.08.0~dfsg-110.08.0~dfsg-2
 None known
ghostscript
Debian:13
 All versions, plus listed versions
10.05.1~dfsg-110.05.1~dfsg-1+deb13u110.05.1~dfsg-1+deb13u210.05.1~dfsg-210.05.1~dfsg-3
Show 8 moreShow less
10.06.0~dfsg-110.06.0~dfsg-210.06.0~dfsg-310.07.0~dfsg-110.07.0~dfsg-210.07.1~dfsg-110.08.0~dfsg-110.08.0~dfsg-2
 None known
ghostscript
Debian:14
 before 10.06.0~dfsg-1, plus listed versions
10.05.1~dfsg-110.05.1~dfsg-210.05.1~dfsg-3
10.06.0~dfsg-1
ghostscript
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 10.06.0-2.1
10.06.0-2.1
ghostscript
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 10.06.0-160000.1.1
10.06.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-59801 is a medium vulnerability (CVSS 4.3) in Artifex Ghostxps, published September 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in ghostscript 10.06.0-r0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open