CVE-2025-27834
Published: 25 March 2025
Summary
CVE-2025-27834 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Artifex Ghostscript. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 21.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely flaw remediation, directly addressing the buffer overflow by updating Ghostscript to version 10.05.0 or later.
SI-16 implements memory protections like ASLR and DEP that prevent exploitation of the buffer overflow for arbitrary code execution.
SI-10 enforces input validation to check for oversized Type 4 functions in PDFs, mitigating the oversized input trigger for the buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in Ghostscript PDF parser enables arbitrary code execution when user opens malicious PDF (e.g., email attachment), directly mapping to client application exploitation and malicious file execution.
NVD Description
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.
Deeper analysisAI
CVE-2025-27834 is a buffer overflow vulnerability (CWE-120) affecting Artifex Ghostscript versions prior to 10.05.0. The flaw occurs in the pdf/pdf_func.c component when processing an oversized Type 4 function embedded in a PDF document, potentially leading to memory corruption.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A local attacker with no privileges required can exploit it by tricking a user into opening a specially crafted PDF file, such as via email attachment or file share. Successful exploitation enables high-impact outcomes, including arbitrary code execution, data disclosure, modification, or denial of service on the affected system.
Ghostscript version 10.05.0 addresses this issue. Further technical details and patch information are documented in the upstream bug report at https://bugs.ghostscript.com/show_bug.cgi?id=708253.
Details
- CWE(s)