{"id":"CVE-2025-46646","aliases":["ALPINE-CVE-2025-46646","BELL-CVE-2025-46646","DEBIAN-CVE-2025-46646","EUVD-2025-12483","GHSA-56g6-5g9j-wjc3","SUSE-SU-2026:21363-1","UBUNTU-CVE-2025-46646","USN-7473-1","openSUSE-SU-2025:15413-1","openSUSE-SU-2026:20592-1"],"status":"published","title":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8...","description":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.","severity":{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00184,"percentile":0.08033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-24"],"published":"2025-04-26T00:00:00Z","modified":"2026-11-03T06:33:00Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"ghostscript","fixed_in":["10.05.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ghostscript","fixed_in":["10.05.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ghostscript","fixed_in":["10.05.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ghostscript","fixed_in":["10.05.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ghostscript","fixed_in":["10.05.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ghostscript","fixed_in":["10.05.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ghostscript","fixed_in":["10.05.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"ghostscript","fixed_in":["10.01.2-r5"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"ghostscript","fixed_in":["10.05.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ghostscript","fixed_in":["10.05.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["10.05.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","fixed_in":["10.02.1~dfsg1-0ubuntu7.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r0"},{"fixed":"10.01.2-r5"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r0"},{"fixed":"10.05.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1~dfsg1-0ubuntu7.6"}]}],"versions":["10.01.2~dfsg1-0ubuntu2","10.01.2~dfsg1-0ubuntu2.1","10.02.1~dfsg1-0ubuntu1","10.02.1~dfsg1-0ubuntu2","10.02.1~dfsg1-0ubuntu5","10.02.1~dfsg1-0ubuntu6","10.02.1~dfsg1-0ubuntu7","10.02.1~dfsg1-0ubuntu7.1","10.02.1~dfsg1-0ubuntu7.3","10.02.1~dfsg1-0ubuntu7.4","10.02.1~dfsg1-0ubuntu7.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1~dfsg1-0ubuntu7.6"}]}],"versions":["10.01.2~dfsg1-0ubuntu2","10.01.2~dfsg1-0ubuntu2.1","10.02.1~dfsg1-0ubuntu1","10.02.1~dfsg1-0ubuntu2","10.02.1~dfsg1-0ubuntu5","10.02.1~dfsg1-0ubuntu6","10.02.1~dfsg1-0ubuntu7","10.02.1~dfsg1-0ubuntu7.1","10.02.1~dfsg1-0ubuntu7.3","10.02.1~dfsg1-0ubuntu7.4","10.02.1~dfsg1-0ubuntu7.5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0-160000.1.1"}]}],"bundled":6}],"products":[{"vendor":"artifex","product":"ghostscript"}],"references":[{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=708311","tags":["Issue Tracking","report"]},{"url":"https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f14ea81e6c3d2f51593f23cdf13c4679a18f1a3f","tags":["Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46646"},{"url":"https://github.com/advisories/GHSA-56g6-5g9j-wjc3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-46646","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-46646","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-46646","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621363-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243701","tags":["report"]},{"url":"https://bugzilla.suse.com/1245896","tags":["report"]},{"url":"https://bugzilla.suse.com/1250353","tags":["report"]},{"url":"https://bugzilla.suse.com/1250354","tags":["report"]},{"url":"https://bugzilla.suse.com/1250355","tags":["report"]},{"url":"https://bugzilla.suse.com/1257699","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59801","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-46646","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46646","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7473-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-46646","description":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.","status":"published","published":"2025-04-26T00:00:00Z","modified":"2025-04-29T15:23:02.33Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T14:32:36.385228Z"}],"euvd":[{"id":"EUVD-2025-12483","description":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.","status":"published","published":"2025-04-26T00:00:00Z","modified":"2025-04-29T15:23:02Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-56g6-5g9j-wjc3","title":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8...","description":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.","status":"published","published":"2025-04-26T15:30:31Z","modified":"2025-04-26T15:30:36Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T15:02:02.261137Z"}],"nvd":[{"id":"CVE-2025-46646","description":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.","status":"published","published":"2025-04-26T15:15:45.057Z","modified":"2026-06-17T09:26:46.18Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T14:11:02.570368Z"}],"osv":[{"id":"ALPINE-CVE-2025-46646","description":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.","status":"published","published":"2025-04-26T15:15:45.057Z","modified":"2026-11-03T06:33:00.639420886Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2025-46646","status":"published","published":"2025-04-29T05:58:45.356624Z","modified":"2026-01-26T09:40:27.572997Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-46646","description":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.","status":"published","published":"2025-04-26T15:15:45.057Z","modified":"2026-04-29T18:29:34.47475315Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"DEBIAN-CVE-2025-46646","description":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.","status":"published","published":"2025-04-26T15:15:45.057Z","modified":"2026-09-01T20:05:52.702506167Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"UBUNTU-CVE-2025-46646","description":"In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.","status":"published","published":"2025-04-26T15:15:00Z","modified":"2026-04-22T16:04:54.599984Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"openSUSE-SU-2025:15413-1","title":"ghostscript-10.05.1-1.1 on GA media","description":"These are all security issues fixed in the ghostscript-10.05.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-06T00:00:00Z","modified":"2026-03-23T04:53:44.41619Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20592-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\nUpdate to version 10.06.0.\n\nSecurity issues fixed:\n\n- CVE-2025-59800: an integer overflow can lead to a heap-based buffer overflow in ocr_line8 (bsc#1250355).\n- CVE-2025-59799: a large size value can cause a stack-based buffer overflow in pdfmark_coerce_dest (bsc#1250354).\n- CVE-2025-59798: stack-based buffer overflow in pdf_write_cmap can lead to a denial-of-service (bsc#1250353).\n- CVE-2025-48708: lacks of argument sanitization may lead to password disclosure (bsc#1243701).\n- CVE-2025-46646: mishandling of overlong utf-8 encoding in artifex ghostscript's decode_utf8 function (bsc#1257699).\n\nOther updates and bugfixes:\n\n- switch over to libalternatives for ghostscript to provide a gs\n  variant (bsc#1245896)\n\n- Version upgrade to 10.06.0:\n\n  * removes the non-standard operator \"selectdevice\"\n    (cf. the entry below dated Tue Apr  1 09:56:06 UTC 2025)\n\n- Version upgrade to 10.05.1:\n\n  * an overflow issue in Freetype on platforms\n      where long is a 4 byte (rather than 8 byte) type\n      (Microsoft Windows, for example) causing corrupted\n      glyph rendering at higher resolutions\n  * an issue with embedded files, affecting Zugferd\n      format PDF creation.\n  * broken logic in PDF Optional Content processing\n  * potential slow down due to searching for identifiable\n      font files\n  * a small number of extreme edge case segmentation faults.\n","status":"published","published":"2026-04-21T09:49:39Z","modified":"2026-04-23T18:26:50.459659Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21363-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\nUpdate to version 10.06.0.\n\nSecurity issues fixed:\n\n- CVE-2025-59800: an integer overflow can lead to a heap-based buffer overflow in ocr_line8 (bsc#1250355).\n- CVE-2025-59799: a large size value can cause a stack-based buffer overflow in pdfmark_coerce_dest (bsc#1250354).\n- CVE-2025-59798: stack-based buffer overflow in pdf_write_cmap can lead to a denial-of-service (bsc#1250353).\n- CVE-2025-48708: lacks of argument sanitization may lead to password disclosure (bsc#1243701).\n- CVE-2025-46646: mishandling of overlong utf-8 encoding in artifex ghostscript's decode_utf8 function (bsc#1257699).\n\nOther updates and bugfixes:\n\n- switch over to libalternatives for ghostscript to provide a gs\n  variant (bsc#1245896)\n\n- Version upgrade to 10.06.0:\n\n  * removes the non-standard operator \"selectdevice\"\n    (cf. the entry below dated Tue Apr  1 09:56:06 UTC 2025)\n\n- Version upgrade to 10.05.1:\n\n  * an overflow issue in Freetype on platforms\n      where long is a 4 byte (rather than 8 byte) type\n      (Microsoft Windows, for example) causing corrupted\n      glyph rendering at higher resolutions\n  * an issue with embedded files, affecting Zugferd\n      format PDF creation.\n  * broken logic in PDF Optional Content processing\n  * potential slow down due to searching for identifiable\n      font files\n  * a small number of extreme edge case segmentation faults.\n","status":"published","published":"2026-04-21T09:48:49Z","modified":"2026-04-29T18:23:58.003052Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-7473-1","title":"ghostscript vulnerability","description":"It was discovered that Ghostscript incorrectly handled parsing certain PS\nfiles. An attacker could use this issue to cause Ghostscript to crash,\nresulting in a denial of service, or possibly bypass file path validation.\n","status":"published","published":"2025-05-01T11:45:15Z","modified":"2026-04-22T10:57:29.857851Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}