Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2025-7462: Artifex GhostPDL: PDF file handling error can cause system crash
CVE-2025-7462 · published 1 year ago
Summary
A bug in Artifex GhostPDL can cause a program to crash when handling certain PDF files. This could potentially allow a hacker to remotely cause a denial-of-service attack on a system using this software. To fix this, update to the latest version of Artifex GhostPDL and apply the recommended patch.
What to do
- Update debian ghostscript to version 9.53.3~dfsg-7+deb11u11.
- Update debian ghostscript to version 10.0.0~dfsg-11+deb12u8.
- Update debian ghostscript to version 10.05.1~dfsg-1+deb13u1.
- Update debian ghostscript to version 10.05.1~dfsg-2.
- Update debian rootio-ghostscript to version 10.0.0~dfsg-11+deb12u7.root.io.5.
- Update canonical ghostscript to version 9.55.0~dfsg1-0ubuntu5.13.
- Update canonical ghostscript to version 10.02.1~dfsg1-0ubuntu7.8.
- Update canonical ghostscript to version 10.05.0dfsg1-0ubuntu4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | ghostscript |
< 9.53.3~dfsg-7+deb11u11 Fix: upgrade to 9.53.3~dfsg-7+deb11u11
|
| Debian:12 | debian | ghostscript |
< 10.0.0~dfsg-11+deb12u8 Fix: upgrade to 10.0.0~dfsg-11+deb12u8
|
| Debian:13 | debian | ghostscript |
< 10.05.1~dfsg-1+deb13u1 Fix: upgrade to 10.05.1~dfsg-1+deb13u1
|
| Debian:14 | debian | ghostscript |
< 10.05.1~dfsg-2 Fix: upgrade to 10.05.1~dfsg-2
|
| Root:Debian:12 | debian | rootio-ghostscript |
< 10.0.0~dfsg-11+deb12u7.root.io.5 Fix: upgrade to 10.0.0~dfsg-11+deb12u7.root.io.5
|
| Ubuntu:Pro:16.04:LTS | canonical | ghostscript | All versions |
| Ubuntu:22.04:LTS | canonical | ghostscript |
< 9.55.0~dfsg1-0ubuntu5.13 Fix: upgrade to 9.55.0~dfsg1-0ubuntu5.13
|
| Ubuntu:24.04:LTS | canonical | ghostscript |
< 10.02.1~dfsg1-0ubuntu7.8 Fix: upgrade to 10.02.1~dfsg1-0ubuntu7.8
|
| Ubuntu:25.10 | canonical | ghostscript |
< 10.05.0dfsg1-0ubuntu4 Fix: upgrade to 10.05.0dfsg1-0ubuntu4
|
Original advisory text
A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/...
A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer dereference. It is possible to initiate the attack remotely. The identifier of the patch is 619a106ba4c4abed95110f84d5efcd7aee38c7cb. It is recommended to apply a patch to fix this issue.
References
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=619a106ba4...
- https://lists.debian.org/debian-lts-announce/2025/10/msg00010.html
- https://artifex.com/ Third Party Advisory
- https://vuldb.com/?ctiid.316113 Third Party Advisory
- https://vuldb.com/?id.316113 Third Party Advisory
- https://vuldb.com/?submit.610173 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-7462 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-7462 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-7462 Third Party Advisory
- https://ubuntu.com/security/notices/USN-7782-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-404Improper Resource Shutdown or Release
CWE-476NULL Pointer Dereference
Timeline
Published12 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta