CVE-2025-59800: 
Ghostscript vulnerability analysis and mitigation

CVE-2025-59800 affects Artifex Ghostscript through version 10.05.1. The vulnerability was discovered on June 13, 2025, and involves an integer overflow vulnerability in the ocrbeginpage function within devices/gdevpdfocr.c that leads to a heap-based buffer overflow in ocrline8 ([Ghostscript Bug](https://bugs.ghostscript.com/showbug.cgi?id=708602)).

The vulnerability stems from an integer overflow condition in the ocrbeginpage function located in devices/gdevpdfocr.c line 526. This overflow occurs during memory allocation calculations, which subsequently leads to a heap-based buffer overflow in the ocr_line8 function at line 461. The vulnerability has been assigned a CVSS 3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N (NVD CVE).

The vulnerability allows for heap-based buffer overflow conditions, which could potentially lead to memory corruption. The CVSS scoring indicates that while the vulnerability has local access requirements, it can affect confidentiality and integrity of the system (NVD CVE).

The vulnerability has been fixed in Ghostscript with commit 176cf0188a2294bc307b8caec876f39412e58350. The fix involves adding proper bounds checking for the raster size calculation to prevent integer overflow conditions. Users should upgrade to versions containing this fix (Ghostscript Commit).