Skip to content
Fencer Intel
critical 9.8

CVE-2025-27832 json

An issue was discovered in Artifex Ghostscript before 10.05.0.

published last yr. modified 4mo ago also EUVD-2025-8093

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.

Patch / fix

  • artifex ghostscript 10.05.0
  • ghostscript ghostscript 10.05.0
  • ghostscript Debian 12 10.0.0~dfsg-11+deb12u7
  • ghostscript Debian 14, Debian 13 10.05.0~dfsg-1

debian advisories DEBIAN-CVE-2025-27832

  • ghostscript Ubuntu 20.04 LTS 9.50~dfsg-5ubuntu4.15
  • ghostscript Ubuntu 22.04 LTS 9.55.0~dfsg1-0ubuntu5.11
  • ghostscript Ubuntu 24.04 LTS 10.02.1~dfsg1-0ubuntu7.5
  • ghostscript Ubuntu Pro 16.04 LTS 9.26~dfsg+0-0ubuntu0.16.04.14+esm9
  • ghostscript Ubuntu Pro 18.04 LTS 9.26~dfsg+0-0ubuntu0.18.04.18+esm4

ubuntu advisories UBUNTU-CVE-2025-27832

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ghostscript RHEL 8 9.27-17.el8_10
  • libgs RHEL 8 9.27-17.el8_10
  • ghostscript-x11 RHEL 8 9.27-17.el8_10
  • ghostscript-tools-fonts RHEL 8 9.27-17.el8_10
  • ghostscript-tools-dvipdf RHEL 8 9.27-17.el8_10
  • ghostscript-tools-printing RHEL 8 9.27-17.el8_10
  • ghostscript RHEL 10.0 10.02.1-16.el10_0
  • libgs RHEL 10.0 10.02.1-16.el10_0

red hat advisories RHSA-2025:23153RHSA-2025:22869RHSA-2025:21915RHSA-2025:8421RHSA-2025:7593RHSA-2025:7586

  • ghostscript SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +13 more 9.52-150000.203.1
  • ghostscript SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.52-23.89.1

suse advisories SUSE-SU-2025:1127-1SUSE-SU-2025:1118-1

  • ghostscript openSUSE Tumbleweed 10.05.0-1.1

opensuse advisories openSUSE-SU-2025:14953-1

  • ghostscript AlmaLinux 8 9.27-17.el8_10
  • libgs AlmaLinux 8 9.27-17.el8_10
  • ghostscript-x11 AlmaLinux 8 9.27-17.el8_10
  • ghostscript-tools-fonts AlmaLinux 8 9.27-17.el8_10
  • ghostscript-tools-dvipdf AlmaLinux 8 9.27-17.el8_10
  • ghostscript-tools-printing AlmaLinux 8 9.27-17.el8_10
  • ghostscript AlmaLinux 9 9.54.0-19.el9_6
  • libgs AlmaLinux 9 9.54.0-19.el9_6

almalinux advisories ALSA-2025:8421ALSA-2025:7586ALSA-2025:7593

  • ghostscript Rocky Linux 9 9.54.0-19.el9_6
  • ghostscript Rocky Linux 10 10.02.1-16.el10_0
  • ghostscript Rocky Linux 8 9.27-17.el8_10

rocky linux advisories RLSA-2025:7586RLSA-2025:7593RLSA-2025:8421

  • ghostscript Alpine 3.18 10.05.0
  • ghostscript Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 10.05.0-r0

alpine advisories ALPINE-CVE-2025-27832

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2025-27832 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-27832 updated cvss 5.5

Ghostscript: NPDL device: Compression buffer overflow

  • Red Hat Enterprise Linux 6 ghostscript, ghostscript-gtk Red Hat Enterprise Linux 7 libgs, ghostscript, ghostscript-gtk, ghostscript-cups
    affected: workaround, no fix available “Fix deferred”
  • Red Hat CodeReady Linux Builder EUS (v.9.4) ghostscript 9.54.0-17.el9_4.1, ghostscript-tools-fonts 9.54.0-17.el9_4.1, ghostscript-tools-printing 9.54.0-17.el9_4.1
    fixed: vendor fix RHSA-2025:21915
  • Red Hat Enterprise Linux AppStream (v. 8) libgs 9.27-17.el8_10, ghostscript 9.27-17.el8_10, ghostscript-x11 9.27-17.el8_10
    fixed: vendor fix RHSA-2025:8421
  • Red Hat Enterprise Linux AppStream (v. 9) libgs 9.54.0-19.el9_6, ghostscript 9.54.0-19.el9_6, ghostscript-x11 9.54.0-19.el9_6, ghostscript-tools-fonts 9.54.0-19.el9_6, ghostscript-tools-dvipdf 9.54.0-19.el9_6, ghostscript-tools-printing 9.54.0-19.el9_6
    fixed: vendor fix RHSA-2025:7586
  • Red Hat Enterprise Linux AppStream (v. 10) libgs 10.02.1-16.el10_0, ghostscript 10.02.1-16.el10_0, ghostscript-tools-fonts 10.02.1-16.el10_0, ghostscript-tools-printing 10.02.1-16.el10_0
    fixed: vendor fix RHSA-2025:7593
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) libgs 9.54.0-7.el9_0.4, ghostscript 9.54.0-7.el9_0.4, ghostscript-x11 9.54.0-7.el9_0.4, ghostscript-tools-fonts 9.54.0-7.el9_0.4, ghostscript-tools-dvipdf 9.54.0-7.el9_0.4, ghostscript-tools-printing 9.54.0-7.el9_0.4
    fixed: vendor fix RHSA-2025:23153
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libgs 9.54.0-12.el9_2.3, ghostscript 9.54.0-12.el9_2.3, ghostscript-x11 9.54.0-12.el9_2.3, ghostscript-tools-fonts 9.54.0-12.el9_2.3, ghostscript-tools-dvipdf 9.54.0-12.el9_2.3, ghostscript-tools-printing 9.54.0-12.el9_2.3
    fixed: vendor fix RHSA-2025:22869
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) libgs 9.54.0-17.el9_4.1, ghostscript 9.54.0-17.el9_4.1, ghostscript-x11 9.54.0-17.el9_4.1, ghostscript-tools-fonts 9.54.0-17.el9_4.1, ghostscript-tools-dvipdf 9.54.0-17.el9_4.1, ghostscript-tools-printing 9.54.0-17.el9_4.1
    fixed: vendor fix RHSA-2025:21915
show 3 more
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) ghostscript 9.54.0-19.el9_6, ghostscript-tools-fonts 9.54.0-19.el9_6, ghostscript-tools-printing 9.54.0-19.el9_6
    fixed: vendor fix RHSA-2025:7586
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ghostscript-tools-dvipdf 10.02.1-16.el10_0
    fixed: vendor fix RHSA-2025:7593
  • Red Hat Enterprise Linux CRB (v. 8) ghostscript-tools-fonts 9.27-17.el8_10, ghostscript-tools-dvipdf 9.27-17.el8_10, ghostscript-tools-printing 9.27-17.el8_10
    fixed: vendor fix RHSA-2025:8421

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
last yr.

Exploit prediction

0.84% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.