CVE-2025-59801: Artifex GhostXPS Buffer Overflow Flaw

CVE-2025-59801 Overview

CVE-2025-59801 is a stack-based buffer overflow vulnerability in Artifex GhostXPS versions before 10.06.0. The flaw resides in the xps_unpredict_tiff function within xpstiff.c, where the samplesperpixel value from a TIFF image is not validated before use. An attacker who supplies a crafted XPS document containing a malicious embedded TIFF can trigger the overflow during local processing. The issue is tracked as [CWE-121] Stack-based Buffer Overflow and affects the XPS interpreter shipped as part of the Ghostscript/GhostPDL project.

Critical Impact
A crafted XPS file processed by a vulnerable GhostXPS build can corrupt the stack, leading to integrity impact and potential control-flow disruption on the local host.

Affected Products

Artifex GhostXPS versions prior to 10.06.0
GhostPDL distributions that bundle vulnerable GhostXPS builds
Downstream applications and print pipelines invoking gxps for XPS-to-raster conversion

Discovery Timeline

2025-09-22 - CVE-2025-59801 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59801

Vulnerability Analysis

GhostXPS parses XPS documents that can embed TIFF image resources. The xps_unpredict_tiff routine in xpstiff.c reverses TIFF horizontal predictor encoding on decoded pixel data. It uses the samplesperpixel tag value from the TIFF header to walk the sample buffer during unpredicting.

Because the code does not check samplesperpixel against the expected bounds of the stack buffer, a crafted TIFF that advertises an unusually large value causes writes past the end of the buffer. This is a classic stack corruption pattern in image-parsing code and maps to [CWE-121].

Exploitation requires an attacker to deliver a malicious XPS document to a user or automated service that renders it with a vulnerable gxps binary. Because Ghostscript components are widely used in server-side print, conversion, and preview pipelines, the local attack surface extends to any service that accepts untrusted XPS content.

Root Cause

The root cause is missing input validation on the TIFF samplesperpixel field before it is used as a loop and index bound in xps_unpredict_tiff. The function trusts attacker-controlled metadata to size stack-based operations, allowing out-of-bounds writes on the stack frame.

Attack Vector

The attack vector is local. An attacker crafts an XPS file that embeds a TIFF image with a manipulated samplesperpixel value, then persuades a user or automated workflow to open or convert the file with GhostXPS. No authentication is required, and no user interaction beyond opening the document is needed.

The vulnerability manifests in TIFF predictor handling inside the XPS interpreter. See the Ghostscript Bug Report #708819 and the upstream fix in Ghostscript Commit 99727069 for technical details.

Detection Methods for CVE-2025-59801

Indicators of Compromise

Unexpected crashes or stack canary violations in gxps or GhostXPS-derived processes when parsing XPS or TIFF content
XPS files containing embedded TIFF images with abnormally large samplesperpixel values in the IFD
Child processes spawned by document conversion services immediately after processing untrusted XPS input

Detection Strategies

Inventory endpoints and servers for GhostXPS or GhostPDL builds earlier than 10.06.0 using software asset management or package queries such as rpm -q ghostpdl and dpkg -l | grep -i ghost
Inspect XPS attachments and uploads for embedded TIFF resources with samplesperpixel values outside the expected 1–4 range for typical color models
Correlate document-processing service crashes with recently ingested XPS files in centralized logs

Monitoring Recommendations

Monitor process termination events for gxps and related GhostPDL executables, especially segmentation faults following file open events
Alert on document conversion workers that spawn unexpected shells or network connections after XPS ingestion
Track file writes to XPS and TIFF paths originating from mail gateways, upload portals, and print servers

How to Mitigate CVE-2025-59801

Immediate Actions Required

Upgrade GhostXPS and any bundled GhostPDL distribution to version 10.06.0 or later
Restrict XPS processing to trusted inputs until patching is complete, particularly on document conversion and print servers
Run gxps and related utilities under least-privileged service accounts with filesystem and network restrictions

Patch Information

The upstream fix is available in Ghostscript Commit 99727069, which adds validation for the samplesperpixel value in xps_unpredict_tiff. The fix is included in GhostPDL 10.06.0. Apply vendor-provided packages when available, or rebuild from source with the patched commit.

Workarounds

Block or quarantine untrusted XPS files at mail and web gateways until vulnerable systems are patched
Sandbox gxps invocations with seccomp, AppArmor, or SELinux profiles to contain post-exploitation activity
Disable XPS support in document conversion pipelines where the format is not required

bash

# Verify installed GhostPDL/GhostXPS version and upgrade
gxps --version

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade ghostpdl

# RHEL/Fedora
sudo dnf upgrade ghostpdl

# Confirm patched version (>= 10.06.0)
gxps --version