CVE-2025-59799: 
Ghostscript vulnerability analysis and mitigation

CVE-2025-59799 affects Artifex Ghostscript through version 10.05.1. The vulnerability is a stack-based buffer overflow that occurs in the pdfmarkcoercedest function located in devices/vector/gdevpdfm.c. The issue was discovered on May 7, 2025, and was fixed on May 8, 2025 (Ghostscript Bug, Ghostscript Commit).

The vulnerability is caused by a stack-based buffer overflow (CWE-121) in the pdfmarkcoercedest function. The overflow occurs because the destination buffer is statically allocated on the stack, and there was no proper bounds check before the memcpy call. The CVSS v3.1 score for this vulnerability is 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N (NVD).

The vulnerability allows an attacker to cause a buffer overflow through a large size value, which could potentially lead to code execution or system crashes. The CVSS scoring indicates that while the vulnerability has local access requirements, it could have cross-boundary impacts on the affected system (NVD).

The vulnerability has been fixed in Ghostscript commit 6dab38fb211f15226c242ab7a83fa53e4b0ff781. The fix implements proper bounds checking before the buffer copy operation. Users should upgrade to a version containing this fix. The patch adds size validation checks to prevent buffer overflow conditions (Ghostscript Commit).