CVE-2025-27835
Published: 25 March 2025
Summary
CVE-2025-27835 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Artifex Ghostscript. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 18.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely identification, reporting, and correction of the buffer overflow flaw in Ghostscript before 10.05.0 via patching to version 10.05.0 or later.
Implements memory protections such as ASLR, DEP, and stack canaries that prevent successful exploitation of the buffer overflow for arbitrary code execution.
Requires vulnerability scanning to identify systems with vulnerable Ghostscript installations affected by CVE-2025-27835, enabling proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in Ghostscript file processing (glyph/Unicode conversion) enables arbitrary code execution via crafted malicious file opened by user, directly mapping to client-side exploitation and malicious file delivery.
NVD Description
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.
Deeper analysisAI
CVE-2025-27835 is a buffer overflow vulnerability (CWE-120) discovered in Artifex Ghostscript versions before 10.05.0. The flaw occurs in the psi/zbfont.c component during the conversion of glyphs to Unicode, which can lead to memory corruption when processing malformed input.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A local attacker with no privileges can exploit it by tricking a user into processing a specially crafted file with an affected Ghostscript instance, such as via a PDF viewer or command-line invocation. Successful exploitation could allow arbitrary code execution with the privileges of the Ghostscript process, resulting in high impacts to confidentiality, integrity, and availability.
Advisories recommend upgrading to Ghostscript 10.05.0 or later to mitigate the issue. Additional details are available in the Ghostscript bug report at https://bugs.ghostscript.com/show_bug.cgi?id=708131 and the Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2025/04/msg00014.html.
Details
- CWE(s)