Cyber Posture

CVE-2025-27834

High

Published: 25 March 2025

Published
25 March 2025
Modified
01 April 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0007 21.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-27834 is a buffer overflow vulnerability (CWE-120) affecting Artifex Ghostscript versions prior to 10.05.0. The flaw occurs in the pdf/pdf_func.c component when processing an oversized Type 4 function embedded in a PDF document, potentially leading to memory corruption.

The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A local attacker with no privileges required can exploit it by tricking a user into opening a specially crafted PDF file, such as via email attachment or file share. Successful exploitation enables high-impact outcomes, including arbitrary code execution, data disclosure, modification, or denial of service on the affected system.

Ghostscript version 10.05.0 addresses this issue. Further technical details and patch information are documented in the upstream bug report at https://bugs.ghostscript.com/show_bug.cgi?id=708253.

Details

CWE(s)
CWE-120

Affected Products

artifex
ghostscript
≤ 10.05.0

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Buffer overflow in Ghostscript PDF parser enables arbitrary code execution when user opens malicious PDF (e.g., email attachment), directly mapping to client application exploitation and malicious file execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References