Artifex Ghostscript up to 10.04.0 BJ10V Device gdev10v.c buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in Artifex Ghostscript. This affects an unknown function of the file contrib/japanese/gdev10v.c of the component BJ10V Device. This manipulation causes buffer overflow. The identification of this vulnerability is CVE-2025-27836. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Artifex Ghostscript. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file contrib/japanese/gdev10v.c of the component BJ10V Device. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.

The advisory is shared at bugs.ghostscript.com. This vulnerability is known as CVE-2025-27836 since 03/07/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 233372 (Debian dsa-5888 : ghostscript - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 10.05.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (233372) and CERT Bund (WID-SEC-2025-0556). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• SUSE openSUSE
• Open Source Ghostscript

Productinfo

Type

• Document Processing Software

Vendor

• Artifex

Name

• Ghostscript

Version

• 8.63
• 8.70
• 9.20
• 9.21
• 9.21rc1
• 9.22
• 9.23
• 9.24
• 9.25
• 9.26
• 9.50
• 9.51
• 9.52
• 9.53.0
• 10.0.3.0
• 10.03.0
• 10.03.1
• 10.04.0

License

• free

Website

• Vendor: https://artifex.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion