CVE-2025-59800: 
Ghostscript vulnerability analysis and mitigation

CVE-2025-59800 affects Artifex Ghostscript through version 10.05.1. The vulnerability stems from an integer overflow in the ocrbeginpage function within devices/gdevpdfocr.c, which leads to a heap-based buffer overflow in ocrline8. The issue was discovered on June 13, 2025, and was publicly disclosed with a fix on July 1, 2025 ([Ghostscript Bug](https://bugs.ghostscript.com/showbug.cgi?id=708602)).

The vulnerability occurs due to an integer overflow during memory allocation in the ocrbeginpage function located in devices/gdevpdfocr.c line 526. This overflow subsequently leads to a heap-based buffer overflow in the ocr_line8 function at line 461. The CVSS 3.1 score is 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause Ghostscript to crash, resulting in a denial of service. Under certain conditions, there is also the potential for arbitrary code execution (Ubuntu Notice).

A fix has been implemented in commit 176cf0188a2294bc307b8caec876f39412e58350, which adds a range check before memory allocation. Users should upgrade to the patched versions available through their distribution channels. Ubuntu has released fixes in versions 10.05.0dfsg1-0ubuntu1.2 for Ubuntu 25.04, 10.02.1~dfsg1-0ubuntu7.8 for Ubuntu 24.04 LTS, and 9.55.0~dfsg1-0ubuntu5.13 for Ubuntu 22.04 LTS (Ubuntu Notice).