Bug 2354947 (CVE-2025-27835) - CVE-2025-27835 Ghostscript: Buffer overflow when converting glyphs to unicode
Summary: CVE-2025-27835 Ghostscript: Buffer overflow when converting glyphs to unicode
Keywords:
Status: NEW
Alias: CVE-2025-27835
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2355025 2355026
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-03-25 21:01 UTC by OSIDB Bzimport
Modified: 2025-11-06 10:26 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-03-25 21:01:22 UTC 
An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.
Comment 2 Roman Karwacik 2025-11-06 10:24:55 UTC 
This and many more CVEs published in the same batch ( CVE-2025-27837,CVE-2025-27836,CVE-2025-27835,CVE-2025-27834,CVE-2025-27833,CVE-2025-27832,CVE-2025-27831,CVE-2025-27830 ) and some newer ones are still not fixed in RedHat Stream 8/9 and similar distributions such as Alma or Rocky.
For this CVE and some of the others in the batch there are public RCE exploits, see for example https://bugs.ghostscript.com/show_bug.cgi?id=708131
Many products use Ghostscript in their pipelines, such as ImageMagick and LibreOffice, and are exposed to the internet which makes this a remotely exploitable RCE vulnerability in many cases.

Why are all of these vulnerabilities not fixed, even though patches are available?
Comment 3 Roman Karwacik 2025-11-06 10:26:13 UTC 
Small correction, CVE-2025-27832 seems to be the only one fixed from the batch https://gitlab.com/redhat/centos-stream/rpms/ghostscript/-/commit/97942d253f6a69621ed610d37ef026af81963da0
Note You need to log in before you can comment on or make changes to this bug.