CVE-2025-7462
published 2025-07-12CVE-2025-7462: A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function…
PriorityP418medium4.3CVSS 3.1
AVNACLPRNUIRSUCNINAL
EPSS
0.39%
31.1th percentile
A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer dereference. It is possible to initiate the attack remotely. The identifier of the patch is 619a106ba4c4abed95110f84d5efcd7aee38c7cb. It is recommended to apply a patch to fix this issue.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | ghostpdl | — | — |
| artifex | ghostscript | >= 0 < 9.53.3~dfsg-7+deb11u11 | 9.53.3~dfsg-7+deb11u11 |
| artifex | ghostscript | >= 0 < 10.0.0~dfsg-11+deb12u8 | 10.0.0~dfsg-11+deb12u8 |
| artifex | ghostscript | >= 0 < 10.05.1~dfsg-1+deb13u1 | 10.05.1~dfsg-1+deb13u1 |
| artifex | ghostscript | >= 0 < 10.05.1~dfsg-2 | 10.05.1~dfsg-2 |
| artifex | ghostscript | >= 0 < 9.55.0~dfsg1-0ubuntu5.13 | 9.55.0~dfsg1-0ubuntu5.13 |
| artifex | ghostscript | >= 0 < 10.02.1~dfsg1-0ubuntu7.8 | 10.02.1~dfsg1-0ubuntu7.8 |
| debian | ghostscript | < ghostscript 10.0.0~dfsg-11+deb12u8 (bookworm) | ghostscript 10.0.0~dfsg-11+deb12u8 (bookworm) |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.3MEDIUM
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ghostscript vulnerabilities
osv·2025-09-29·CVSS 5.5
CVE-2025-7462 [MEDIUM] ghostscript vulnerabilities
ghostscript vulnerabilities
It was discovered that Ghostscript incorrectly handled opening a file to
write. An attacker could possibly use this issue to cause Ghostscript to
crash, resulting in a denial of service (CVE-2025-7462)
It was discovered that Ghostscript incorrectly handled writing certain
files. An attacker could possibly use this issue to cause Ghostscript to
crash, resulting in a denial of service (CVE-2025-59798, CVE-2025-59799)
It was discovered that Ghostscript incorrectly handled performing OCR on
certain files. An attacker could use this issue to cause Ghostscript to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-59800)
GHSA
GHSA-hf2c-wp2p-xqr9: A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145
ghsa_unreviewed·2025-07-12
CVE-2025-7462 [MEDIUM] CWE-404 GHSA-hf2c-wp2p-xqr9: A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145
A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer dereference. It is possible to initiate the attack remotely. The identifier of the patch is 619a106ba4c4abed95110f84d5efcd7aee38c7cb. It is recommended to apply a patch to fix this issue.
OSV
CVE-2025-7462: A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145
osv·2025-07-12·CVSS 5.3
CVE-2025-7462 [MEDIUM] CVE-2025-7462: A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145
A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer dereference. It is possible to initiate the attack remotely. The identifier of the patch is 619a106ba4c4abed95110f84d5efcd7aee38c7cb. It is recommended to apply a patch to fix this issue.
Ubuntu
Ghostscript vulnerabilities
vendor_ubuntu·2025-09-29·CVSS 4.3
CVE-2025-59799 [MEDIUM] Ghostscript vulnerabilities
Title: Ghostscript vulnerabilities
Summary: Several security issues were fixed in Ghostscript.
It was discovered that Ghostscript incorrectly handled opening a file to
write. An attacker could possibly use this issue to cause Ghostscript to
crash, resulting in a denial of service (CVE-2025-7462)
It was discovered that Ghostscript incorrectly handled writing certain
files. An attacker could possibly use this issue to cause Ghostscript to
crash, resulting in a denial of service (CVE-2025-59798, CVE-2025-59799)
It was discovered that Ghostscript incorrectly handled performing OCR on
certain files. An attacker could use this issue to cause Ghostscript to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-59800)
Instructions: In general, a standard syste
Debian
CVE-2025-7462: ghostscript - A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902b...
vendor_debian·2025·CVSS 5.3
CVE-2025-7462 [MEDIUM] CVE-2025-7462: ghostscript - A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902b...
A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer dereference. It is possible to initiate the attack remotely. The identifier of the patch is 619a106ba4c4abed95110f84d5efcd7aee38c7cb. It is recommended to apply a patch to fix this issue.
Scope: local
bookworm: resolved (fixed in 10.0.0~dfsg-11+deb12u8)
bullseye: resolved (fixed in 9.53.3~dfsg-7+deb11u11)
forky: resolved (fixed in 10.05.1~dfsg-2)
sid: resolved (fixed in 10.05.1~dfsg-2)
trixie: resolved (fixed in 10.05.1~dfsg-1+deb13u1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-12
Published