CVE-2025-59799: 
Ghostscript vulnerability analysis and mitigation

CVE-2025-59799 is a stack-based buffer overflow vulnerability in Artifex Ghostscript affecting all versions through 10.05.1. The flaw resides in the pdfmark_coerce_dest function within devices/vector/gdevpdfm.c and can be triggered by supplying a large size value during PDF processing. It was published on September 22, 2025, with a patch committed to the Ghostscript git repository shortly after. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, with an availability-only impact under a local attack vector (Red Hat CVE, Ghostscript Commit).

The root cause is a stack-based buffer overflow (CWE-121) in the pdfmark_coerce_dest function in devices/vector/gdevpdfm.c, triggered when processing a PDF file containing an excessively large size value in a pdfmark destination. The attack vector is local (AV:L), requiring low privileges, and exploitation typically involves tricking a user or automated pipeline into processing a maliciously crafted PDF document. The vulnerability was tracked in the Ghostscript bug tracker as bug #708517 and addressed via a specific commit to the ghostpdl repository (Ghostscript Bug, Ghostscript Commit).

Successful exploitation of this vulnerability primarily impacts availability, potentially causing a crash or denial of service of the Ghostscript process through memory corruption on the stack. While the CVSS score reflects no confidentiality or integrity impact, stack-based buffer overflows can in some circumstances be leveraged for arbitrary code execution, particularly if memory protections are insufficient. The impact is limited to the local system and the context of the user or service running Ghostscript, with no direct path to lateral movement identified (Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious PDF: Create a PDF file containing a pdfmark annotation or destination entry with an abnormally large size value designed to overflow the stack buffer in pdfmark_coerce_dest.
2. Deliver the file: Place the malicious PDF in a location accessible to the target — via email attachment, shared network drive, or a web-accessible upload form that feeds into a Ghostscript-based processing pipeline.
3. Trigger processing: Cause the target system or user to process the PDF using a vulnerable version of Ghostscript (≤ 10.05.1), either directly via command line (e.g., gs -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=out.pdf malicious.pdf) or through an application that invokes Ghostscript internally.
4. Achieve denial of service or code execution: The oversized value triggers the stack buffer overflow in gdevpdfm.c, potentially crashing the Ghostscript process or, under favorable conditions, redirecting execution flow (Ghostscript Bug, Ghostscript Commit).

• Process: Unexpected crashes or segmentation faults in the gs (Ghostscript) process, particularly when processing PDF files from untrusted sources.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing Ghostscript process termination with signals such as SIGSEGV or SIGABRT.
• File System: Presence of unusual or externally sourced PDF files in directories used by automated Ghostscript processing pipelines (e.g., print spoolers, document converters).
• Network: Inbound delivery of PDF files from unexpected or unknown external sources to systems running Ghostscript-based document processing services.

The primary remediation is to upgrade Ghostscript to a version beyond 10.05.1, which includes the fix committed to the ghostpdl repository (Ghostscript Commit). Major Linux distributions have released updated packages: Ubuntu (USN-7782-1, USN-7904-1), Debian (DLA-4330-1, DSA-6024-1), SUSE (SUSE-SU-2025:4148-1), and Amazon Linux 2 (ALAS2-2025-3018). As interim workarounds, restrict PDF processing to trusted sources only, apply least-privilege principles to accounts running Ghostscript, and consider application whitelisting to control which tools can process PDF files (Ubuntu Advisory, Amazon Linux).

The vulnerability has received routine coverage from Linux distribution security teams, with patch advisories issued by Ubuntu, Debian, SUSE, Amazon Linux, and Fedora. The Yocto Project security mailing list also tracked the issue across multiple messages. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage.