CVE-2025-59798: 
Ghostscript vulnerability analysis and mitigation

CVE-2025-59798 affects Artifex Ghostscript through version 10.05.1. The vulnerability is a stack-based buffer overflow in the pdfwritecmap function located in devices/vector/gdevpdtw.c. The issue was discovered and reported on May 12, 2025, and was fixed on May 22, 2025 (Ghostscript Bug, Ghostscript Commit).

The vulnerability exists due to insufficient bounds checking before performing a memcpy operation of the CMap name into a statically allocated buffer in the pdfwritecmap function. The CVSS v3.1 base score for this vulnerability is 4.3 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. The issue is classified as CWE-121 (Stack-based Buffer Overflow) (NVD).

The vulnerability could allow an attacker to cause a stack buffer overflow through a specially crafted PDF file. When exploited, this could potentially lead to code execution or system crashes when processing PDF documents with maliciously crafted CMap names (Ghostscript Bug).

The vulnerability has been fixed in Ghostscript commit 0cae41b23a9669e801211dd4cf97b6dadd6dbdd7. The fix replaces the fixed-size buffer with dynamic allocation based on the actual size of the strings being processed, and adds proper error handling for stream operations. Users should upgrade to a version containing this fix (Ghostscript Commit).