CVE-2025-59799

EUVD-2025-30395
Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.71%
Affected Products (NVD)
VendorProductVersion
artifexghostscript
𝑥
≤ 10.05.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ghostscript
bookworm
10.0.0~dfsg-11+deb12u8
fixed
bookworm (security)
10.0.0~dfsg-11+deb12u8
fixed
bullseye
vulnerable
bullseye (security)
9.53.3~dfsg-7+deb11u11
fixed
forky
10.07.1~dfsg-1
fixed
sid
10.07.1~dfsg-1
fixed
trixie
10.05.1~dfsg-1+deb13u1
fixed
trixie (security)
10.05.1~dfsg-1+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ghostscript
bionic
Fixed 9.26~dfsg+0-0ubuntu0.18.04.18+esm5
released
focal
Fixed 9.50~dfsg-5ubuntu4.15+esm2
released
jammy
Fixed 9.55.0~dfsg1-0ubuntu5.13
released
noble
Fixed 10.02.1~dfsg1-0ubuntu7.8
released
plucky
Fixed 10.05.0dfsg1-0ubuntu1.2
released
questing
Fixed 10.05.0dfsg1-0ubuntu4
released
xenial
Fixed 9.26~dfsg+0-0ubuntu0.16.04.14+esm10
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
ghostscript
suse enterprise desktop 15 SP6
9.52-150000.211.1
fixed
suse enterprise desktop 15 SP7
9.52-150000.211.1
fixed
suse enterprise sap 15 SP6
9.52-150000.211.1
fixed
suse enterprise sap 15 SP7
9.52-150000.211.1
fixed
suse enterprise server 15 SP4
9.52-150000.211.1
fixed
suse enterprise server 15 SP6
9.52-150000.211.1
fixed
suse enterprise server 15 SP7
9.52-150000.211.1
fixed
ghostscript-devel
suse enterprise desktop 15 SP6
9.52-150000.211.1
fixed
suse enterprise desktop 15 SP7
9.52-150000.211.1
fixed
suse enterprise sap 15 SP6
9.52-150000.211.1
fixed
suse enterprise sap 15 SP7
9.52-150000.211.1
fixed
suse enterprise server 15 SP4
9.52-150000.211.1
fixed
suse enterprise server 15 SP6
9.52-150000.211.1
fixed
suse enterprise server 15 SP7
9.52-150000.211.1
fixed
ghostscript-x11
suse enterprise desktop 15 SP6
9.52-150000.211.1
fixed
suse enterprise desktop 15 SP7
9.52-150000.211.1
fixed
suse enterprise sap 15 SP6
9.52-150000.211.1
fixed
suse enterprise sap 15 SP7
9.52-150000.211.1
fixed
suse enterprise server 15 SP4
9.52-150000.211.1
fixed
suse enterprise server 15 SP6
9.52-150000.211.1
fixed
suse enterprise server 15 SP7
9.52-150000.211.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ghostscript
Amazon Linux 2
0:9.54.0-9.amzn2.0.13
fixed
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-cups
Amazon Linux 2
0:9.54.0-9.amzn2.0.13
fixed
ghostscript-debuginfo
Amazon Linux 2
0:9.54.0-9.amzn2.0.13
fixed
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-debugsource
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-doc
Amazon Linux 2
0:9.54.0-9.amzn2.0.13
fixed
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-gtk
Amazon Linux 2
0:9.54.0-9.amzn2.0.13
fixed
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-gtk-debuginfo
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-tools-dvipdf
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-tools-fonts
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-tools-printing
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-x11
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
ghostscript-x11-debuginfo
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
libgs
Amazon Linux 2
0:9.54.0-9.amzn2.0.13
fixed
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
libgs-debuginfo
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
libgs-devel
Amazon Linux 2
0:9.54.0-9.amzn2.0.13
fixed
Amazon Linux 2023
0:9.56.1-7.amzn2023.0.19
fixed
Common Weakness Enumeration
References
https://bugs.ghostscript.com/show_bug.cgi?id=708517
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=6dab38fb211f15226c242ab7a83fa53e4b0ff781
https://lists.debian.org/debian-lts-announce/2025/10/msg00010.html
https://bugs.ghostscript.com/show_bug.cgi?id=708517