CVE-2025-27834

High

Published: 25 March 2025

Published

25 March 2025

Modified

01 April 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0007 21.8th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27834 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Artifex Ghostscript. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-27834 is a buffer overflow vulnerability (CWE-120) affecting Artifex Ghostscript versions prior to 10.05.0. The flaw occurs in the pdf/pdf_func.c component when processing an oversized Type 4 function embedded in a PDF document, potentially leading to memory corruption.

The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A local attacker with no privileges required can exploit it by tricking a user into opening a specially crafted PDF file, such as via email attachment or file share. Successful exploitation enables high-impact outcomes, including arbitrary code execution, data disclosure, modification, or denial of service on the affected system.

Ghostscript version 10.05.0 addresses this issue. Further technical details and patch information are documented in the upstream bug report at https://bugs.ghostscript.com/show_bug.cgi?id=708253.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-8091

Vulnerability details

An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.

CWE(s): CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

Why these techniques?

Buffer overflow in Ghostscript PDF parser enables arbitrary code execution when user opens malicious PDF (e.g., email attachment), directly mapping to client application exploitation and malicious file execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0