CVE-2025-27835

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 10.05.0 Ghostscript (affected versions not specified)

Description A buffer overflow issue exists in Ghostscript when converting glyphs to Unicode within the psi/zbfont.c file. This can potentially lead to denial of service or arbitrary code execution if specially crafted document files are processed. The issue affects versions prior to 10.05.0. Reports indicate that this vulnerability has been publicly known for approximately 8 months and may be exploitable through opening malicious LibreOffice documents or via servers utilizing ImageMagick for file conversion. The vulnerable code resides in the psi/zbfont.c file, specifically during the glyph to Unicode conversion process.

Recommendations Upgrade to Ghostscript version 10.05.0 or later. Upgrade to Ghostscript version 10.0.0~dfsg-11+deb12u7 for Debian bookworm distribution. Upgrade to Ghostscript version 10.05.1-alt1.