CVE-2025-27831: Artifex Ghostscript Buffer Overflow Flaw

CVE-2025-27831 Overview

CVE-2025-27831 is a text buffer overflow vulnerability in Artifex Ghostscript versions before 10.05.0. The flaw resides in the DOCXWRITE and TXTWRITE output devices, specifically in devices/vector/doc_common.c. Attackers can trigger the overflow by supplying long characters processed by these vector devices. Ghostscript is widely deployed as a PostScript and PDF interpreter on Linux distributions, print servers, and document processing pipelines, which broadens the exposure of affected systems.

Critical Impact
Processing untrusted PostScript or PDF input with the DOCXWRITE or TXTWRITE devices can corrupt memory, enabling code execution or process compromise.

Affected Products

Artifex Ghostscript versions prior to 10.05.0
Linux distributions bundling vulnerable Ghostscript packages (Debian LTS advisory issued)
Document conversion pipelines using DOCXWRITE or TXTWRITE output devices

Discovery Timeline

2025-03-25 - CVE-2025-27831 published to the National Vulnerability Database (NVD)
2025-04 - Debian LTS security announcement issued for affected Ghostscript packages
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-27831

Vulnerability Analysis

The vulnerability is a classic buffer overflow [CWE-120] in Ghostscript's vector device common code. The DOCXWRITE and TXTWRITE devices, which convert PostScript and PDF input into DOCX and plain text output, share helper routines in devices/vector/doc_common.c. These routines write character data into a fixed-size text buffer without enforcing bounds on inputs containing unusually long characters. When the input exceeds the buffer capacity, adjacent memory is overwritten.

Ghostscript is invoked by many automated pipelines, including mail gateways, CUPS print spoolers, and document conversion services. Untrusted documents reaching these services can pass through the vulnerable code path without user interaction, satisfying the network attack vector profile described in the advisory.

Root Cause

The root cause is missing length validation when copying character data into the text buffer in doc_common.c. The code assumes characters fit within the allocated buffer size, an assumption that breaks for long character glyph names or composed character sequences supplied through crafted input streams.

Attack Vector

An attacker delivers a crafted PostScript or PDF document to a target system that processes it with Ghostscript using the -sDEVICE=docxwrite or -sDEVICE=txtwrite option. The malicious content triggers the overflow during conversion. Successful exploitation can corrupt heap or stack memory adjacent to the text buffer, potentially leading to arbitrary code execution in the context of the Ghostscript process.

No verified public proof-of-concept is currently available. Refer to the Ghostscript Bug Report #708132 for upstream technical analysis.

Detection Methods for CVE-2025-27831

Indicators of Compromise

Unexpected crashes or segmentation faults in gs or gsc processes during document conversion
Ghostscript invocations with -sDEVICE=docxwrite or -sDEVICE=txtwrite processing externally sourced files
Child processes spawned by Ghostscript that perform network connections or shell execution

Detection Strategies

Inventory installed Ghostscript versions across servers and workstations and flag any version below 10.05.0
Monitor process telemetry for Ghostscript crashes coinciding with document conversion workloads
Alert on Ghostscript spawning unexpected child processes such as /bin/sh, bash, or network utilities

Monitoring Recommendations

Forward Ghostscript process events and crash logs to a centralized log platform for correlation
Track command-line arguments invoking the docxwrite and txtwrite devices on conversion servers
Review CUPS, mail gateway, and document pipeline logs for malformed PostScript or PDF submissions

How to Mitigate CVE-2025-27831

Immediate Actions Required

Upgrade Artifex Ghostscript to version 10.05.0 or later on all affected systems
Apply distribution-specific updates, including the patches referenced in the Debian LTS Security Announcement
Audit document processing services for invocations of the docxwrite and txtwrite devices on untrusted input

Patch Information

Artifex addressed the buffer overflow in Ghostscript 10.05.0. Tracking and remediation details are available in Ghostscript Bug Report #708132. Linux distribution maintainers have published corresponding package updates; Debian LTS users should reference the official advisory and install the rebuilt packages.

Workarounds

Disable or restrict use of the DOCXWRITE and TXTWRITE devices in environments that cannot patch immediately
Run Ghostscript under a sandboxed user account with restricted filesystem and network privileges
Validate and constrain input documents before passing them to Ghostscript conversion pipelines

bash

# Configuration example: verify installed Ghostscript version and avoid vulnerable devices
gs --version

# Reject conversion requests that target the affected devices until patched
if echo "$GS_ARGS" | grep -qE 'docxwrite|txtwrite'; then
  echo "Blocked: docxwrite/txtwrite devices disabled pending patch" >&2
  exit 1
fi