{"id":"CVE-2025-59801","aliases":["ALPINE-CVE-2025-59801","DEBIAN-CVE-2025-59801","EUVD-2025-30397","GHSA-h582-rvj3-8qw3","SUSE-SU-2026:21363-1","UBUNTU-CVE-2025-59801","openSUSE-SU-2025:15707-1","openSUSE-SU-2026:20592-1"],"status":"published","title":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff...","description":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.002,"percentile":0.09935,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2025-09-22T00:00:00Z","modified":"2026-11-03T06:32:16Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"ghostscript","fixed_in":["10.06.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ghostscript","fixed_in":["10.06.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["10.06.0~dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0~dfsg-11","10.0.0~dfsg-11+deb12u1","10.0.0~dfsg-11+deb12u2","10.0.0~dfsg-11+deb12u3","10.0.0~dfsg-11+deb12u4","10.0.0~dfsg-11+deb12u5","10.0.0~dfsg-11+deb12u6","10.0.0~dfsg-11+deb12u7","10.0.0~dfsg-11+deb12u8","10.01.2~dfsg-1","10.02.0~dfsg-1","10.02.0~dfsg-2","10.02.1~dfsg-1","10.02.1~dfsg-2","10.02.1~dfsg-3","10.03.0~dfsg-1","10.03.1~dfsg-1","10.03.1~dfsg-2","10.03.1~dfsg~git20240518-1","10.04.0~dfsg-1","10.04.0~dfsg-2","10.05.0~dfsg-1","10.05.1~dfsg-1","10.05.1~dfsg-2","10.05.1~dfsg-3","10.06.0~dfsg-1","10.06.0~dfsg-2","10.06.0~dfsg-3","10.07.0~dfsg-1","10.07.0~dfsg-2","10.07.1~dfsg-1","10.08.0~dfsg-1","10.08.0~dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.05.1~dfsg-1","10.05.1~dfsg-1+deb13u1","10.05.1~dfsg-1+deb13u2","10.05.1~dfsg-2","10.05.1~dfsg-3","10.06.0~dfsg-1","10.06.0~dfsg-2","10.06.0~dfsg-3","10.07.0~dfsg-1","10.07.0~dfsg-2","10.07.1~dfsg-1","10.08.0~dfsg-1","10.08.0~dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0~dfsg-1"}]}],"versions":["10.05.1~dfsg-1","10.05.1~dfsg-2","10.05.1~dfsg-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0-2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0-160000.1.1"}]}],"bundled":6}],"products":[{"vendor":"artifex","product":"ghostxps"}],"references":[{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=708819","tags":["web","report"]},{"url":"https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=99727069197d548a8db69ba5d63f766bff40eaab","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59801"},{"url":"https://github.com/advisories/GHSA-h582-rvj3-8qw3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-59801","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-59801","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621363-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243701","tags":["report"]},{"url":"https://bugzilla.suse.com/1245896","tags":["report"]},{"url":"https://bugzilla.suse.com/1250353","tags":["report"]},{"url":"https://bugzilla.suse.com/1250354","tags":["report"]},{"url":"https://bugzilla.suse.com/1250355","tags":["report"]},{"url":"https://bugzilla.suse.com/1257699","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59801","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-59801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59801","tags":["report"]},{"url":"https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=d12002b16c59e12d97f42fb2c70caded8b1b6aa8","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-59801","description":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.","status":"published","published":"2025-09-22T00:00:00Z","modified":"2025-09-23T13:53:45.701Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-30397","description":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.","status":"published","published":"2025-09-22T00:00:00Z","modified":"2025-09-23T13:53:45Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:40.470019Z"}],"ghsa":[{"id":"GHSA-h582-rvj3-8qw3","title":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff...","description":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.","status":"published","published":"2025-09-22T21:30:20Z","modified":"2025-09-22T21:30:29Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:03:41.453265Z"}],"nvd":[{"id":"CVE-2025-59801","description":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.","status":"published","published":"2025-09-22T04:15:51.047Z","modified":"2026-09-30T23:10:00.237Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:11:30.865098Z"}],"osv":[{"id":"ALPINE-CVE-2025-59801","description":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.","status":"published","published":"2025-09-22T04:15:51.047Z","modified":"2026-11-03T06:32:16.969191355Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"DEBIAN-CVE-2025-59801","description":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.","status":"published","published":"2025-09-22T04:15:51.047Z","modified":"2026-10-01T09:00:25.29240063Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-59801","description":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.","status":"withdrawn","published":"2025-09-22T04:15:00Z","modified":"2025-09-25T05:19:13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"CVE-2025-59801","description":"In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.","status":"published","published":"2025-09-22T04:15:51Z","modified":"2026-04-29T18:29:35.614292204Z","updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"openSUSE-SU-2025:15707-1","title":"ghostscript-10.06.0-2.1 on GA media","description":"These are all security issues fixed in the ghostscript-10.06.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-06T00:00:00Z","modified":"2026-03-23T04:54:07.304934Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20592-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\nUpdate to version 10.06.0.\n\nSecurity issues fixed:\n\n- CVE-2025-59800: an integer overflow can lead to a heap-based buffer overflow in ocr_line8 (bsc#1250355).\n- CVE-2025-59799: a large size value can cause a stack-based buffer overflow in pdfmark_coerce_dest (bsc#1250354).\n- CVE-2025-59798: stack-based buffer overflow in pdf_write_cmap can lead to a denial-of-service (bsc#1250353).\n- CVE-2025-48708: lacks of argument sanitization may lead to password disclosure (bsc#1243701).\n- CVE-2025-46646: mishandling of overlong utf-8 encoding in artifex ghostscript's decode_utf8 function (bsc#1257699).\n\nOther updates and bugfixes:\n\n- switch over to libalternatives for ghostscript to provide a gs\n  variant (bsc#1245896)\n\n- Version upgrade to 10.06.0:\n\n  * removes the non-standard operator \"selectdevice\"\n    (cf. the entry below dated Tue Apr  1 09:56:06 UTC 2025)\n\n- Version upgrade to 10.05.1:\n\n  * an overflow issue in Freetype on platforms\n      where long is a 4 byte (rather than 8 byte) type\n      (Microsoft Windows, for example) causing corrupted\n      glyph rendering at higher resolutions\n  * an issue with embedded files, affecting Zugferd\n      format PDF creation.\n  * broken logic in PDF Optional Content processing\n  * potential slow down due to searching for identifiable\n      font files\n  * a small number of extreme edge case segmentation faults.\n","status":"published","published":"2026-04-21T09:49:39Z","modified":"2026-04-23T18:26:50.459659Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:21363-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issues:\n\nUpdate to version 10.06.0.\n\nSecurity issues fixed:\n\n- CVE-2025-59800: an integer overflow can lead to a heap-based buffer overflow in ocr_line8 (bsc#1250355).\n- CVE-2025-59799: a large size value can cause a stack-based buffer overflow in pdfmark_coerce_dest (bsc#1250354).\n- CVE-2025-59798: stack-based buffer overflow in pdf_write_cmap can lead to a denial-of-service (bsc#1250353).\n- CVE-2025-48708: lacks of argument sanitization may lead to password disclosure (bsc#1243701).\n- CVE-2025-46646: mishandling of overlong utf-8 encoding in artifex ghostscript's decode_utf8 function (bsc#1257699).\n\nOther updates and bugfixes:\n\n- switch over to libalternatives for ghostscript to provide a gs\n  variant (bsc#1245896)\n\n- Version upgrade to 10.06.0:\n\n  * removes the non-standard operator \"selectdevice\"\n    (cf. the entry below dated Tue Apr  1 09:56:06 UTC 2025)\n\n- Version upgrade to 10.05.1:\n\n  * an overflow issue in Freetype on platforms\n      where long is a 4 byte (rather than 8 byte) type\n      (Microsoft Windows, for example) causing corrupted\n      glyph rendering at higher resolutions\n  * an issue with embedded files, affecting Zugferd\n      format PDF creation.\n  * broken logic in PDF Optional Content processing\n  * potential slow down due to searching for identifiable\n      font files\n  * a small number of extreme edge case segmentation faults.\n","status":"published","published":"2026-04-21T09:48:49Z","modified":"2026-04-29T18:23:58.003052Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}