https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-59800.htmlhttps://patchthecve.com/cve/CVE-2025-59800.htmlWed, 17 Jun 2026 09:46:44 +0000MEDIUM 4.3: In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.https://patchthecve.com/cve/CVE-2025-59799.htmlhttps://patchthecve.com/cve/CVE-2025-59799.htmlWed, 17 Jun 2026 09:46:44 +0000MEDIUM 4.3: Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.https://patchthecve.com/cve/CVE-2025-59798.htmlhttps://patchthecve.com/cve/CVE-2025-59798.htmlWed, 17 Jun 2026 09:46:44 +0000MEDIUM 4.3: Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.https://patchthecve.com/cve/CVE-2025-48708.htmlhttps://patchthecve.com/cve/CVE-2025-48708.htmlWed, 17 Jun 2026 09:30:12 +0000MEDIUM 4.0: gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext.https://patchthecve.com/cve/CVE-2025-46646.htmlhttps://patchthecve.com/cve/CVE-2025-46646.htmlWed, 17 Jun 2026 09:26:46 +0000MEDIUM 4.5: In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.https://patchthecve.com/cve/CVE-2025-27837.htmlhttps://patchthecve.com/cve/CVE-2025-27837.htmlWed, 17 Jun 2026 09:04:19 +0000CRITICAL 9.8: An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp.https://patchthecve.com/cve/CVE-2025-27836.htmlhttps://patchthecve.com/cve/CVE-2025-27836.htmlWed, 17 Jun 2026 09:04:18 +0000CRITICAL 9.8: An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.https://patchthecve.com/cve/CVE-2025-27835.htmlhttps://patchthecve.com/cve/CVE-2025-27835.htmlWed, 17 Jun 2026 09:04:18 +0000HIGH 7.8: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.https://patchthecve.com/cve/CVE-2025-27834.htmlhttps://patchthecve.com/cve/CVE-2025-27834.htmlWed, 17 Jun 2026 09:04:18 +0000HIGH 7.8: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.https://patchthecve.com/cve/CVE-2025-27833.htmlhttps://patchthecve.com/cve/CVE-2025-27833.htmlWed, 17 Jun 2026 09:04:18 +0000HIGH 7.8: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.https://patchthecve.com/cve/CVE-2025-27832.htmlhttps://patchthecve.com/cve/CVE-2025-27832.htmlWed, 17 Jun 2026 09:04:18 +0000CRITICAL 9.8: An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c.https://patchthecve.com/cve/CVE-2025-27831.htmlhttps://patchthecve.com/cve/CVE-2025-27831.htmlWed, 17 Jun 2026 09:04:18 +0000CRITICAL 9.8: An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doc_common.c.https://patchthecve.com/cve/CVE-2025-27830.htmlhttps://patchthecve.com/cve/CVE-2025-27830.htmlWed, 17 Jun 2026 09:04:18 +0000HIGH 7.8: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for base/write_t1.c and psi/zfapi.c.https://patchthecve.com/cve/CVE-2024-46956.htmlhttps://patchthecve.com/cve/CVE-2024-46956.htmlWed, 17 Jun 2026 07:56:15 +0000HIGH 7.8: An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution.https://patchthecve.com/cve/CVE-2024-46955.htmlhttps://patchthecve.com/cve/CVE-2024-46955.htmlWed, 17 Jun 2026 07:56:15 +0000MEDIUM 5.5: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space.https://patchthecve.com/cve/CVE-2024-46954.htmlhttps://patchthecve.com/cve/CVE-2024-46954.htmlWed, 17 Jun 2026 07:56:15 +0000HIGH 7.8: An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../ directory traversal.https://patchthecve.com/cve/CVE-2024-46953.htmlhttps://patchthecve.com/cve/CVE-2024-46953.htmlWed, 17 Jun 2026 07:56:15 +0000HIGH 7.8: An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.https://patchthecve.com/cve/CVE-2024-46952.htmlhttps://patchthecve.com/cve/CVE-2024-46952.htmlWed, 17 Jun 2026 07:56:14 +0000HIGH 7.8: An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during handling of a PDF XRef stream (related to W array values).https://patchthecve.com/cve/CVE-2024-46951.htmlhttps://patchthecve.com/cve/CVE-2024-46951.htmlWed, 17 Jun 2026 07:56:14 +0000HIGH 7.8: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution.https://patchthecve.com/cve/CVE-2024-33871.htmlhttps://patchthecve.com/cve/CVE-2024-33871.htmlWed, 17 Jun 2026 07:32:28 +0000HIGH 8.8: An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynhttps://patchthecve.com/cve/CVE-2024-33870.htmlhttps://patchthecve.com/cve/CVE-2024-33870.htmlWed, 17 Jun 2026 07:32:28 +0000MEDIUM 6.3: An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ ishttps://patchthecve.com/cve/CVE-2024-33869.htmlhttps://patchthecve.com/cve/CVE-2024-33869.htmlWed, 17 Jun 2026 07:32:28 +0000MEDIUM 5.3: An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.https://patchthecve.com/cve/CVE-2024-29511.htmlhttps://patchthecve.com/cve/CVE-2024-29511.htmlWed, 17 Jun 2026 07:22:53 +0000HIGH 7.5: Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd.https://patchthecve.com/cve/CVE-2024-29510.htmlhttps://patchthecve.com/cve/CVE-2024-29510.htmlWed, 17 Jun 2026 07:22:53 +0000MEDIUM 6.3: Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.https://patchthecve.com/cve/CVE-2024-29507.htmlhttps://patchthecve.com/cve/CVE-2024-29507.htmlWed, 17 Jun 2026 07:22:53 +0000MEDIUM 5.4: Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.https://patchthecve.com/cve/CVE-2024-29509.htmlhttps://patchthecve.com/cve/CVE-2024-29509.htmlWed, 17 Jun 2026 07:22:53 +0000HIGH 8.8: Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle.https://patchthecve.com/cve/CVE-2024-29508.htmlhttps://patchthecve.com/cve/CVE-2024-29508.htmlWed, 17 Jun 2026 07:22:53 +0000LOW 3.3: Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.https://patchthecve.com/cve/CVE-2024-29506.htmlhttps://patchthecve.com/cve/CVE-2024-29506.htmlWed, 17 Jun 2026 07:22:53 +0000HIGH 8.8: Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name.