CVE-2025-27835

Executive Summary

CVE-2025-27835 is a critical buffer overflow vulnerability discovered in Artifex Ghostscript, a widely used interpreter for PostScript and PDF files. The flaw resides in the psi/zbfont.c file, specifically during the conversion of glyphs to Unicode. A successful exploit could allow an attacker to execute arbitrary code or cause a denial of service by crashing the application. The vulnerability affects all versions of Ghostscript prior to 10.05.0. No public proof-of-concept (PoC) exploit or active exploitation has been reported at this time, but the risk is significant due to Ghostscript's widespread use in document processing pipelines.

Supply Chain & Package Security

Ghostscript is a critical dependency in many Linux distributions, document management systems, and print servers. A compromised Ghostscript binary can lead to supply chain attacks, where malicious documents processed by downstream applications (e.g., ImageMagick, LibreOffice, web applications) can trigger the vulnerability. Organizations should audit their software bill of materials (SBOM) for Ghostscript versions below 10.05.0 and prioritize patching.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, indicating that a full vector has not been assigned by NVD. However, based on the nature of the vulnerability (buffer overflow in a widely deployed interpreter), the following estimated vector is provided:

• Attack Vector (AV): Network (AV:N) – The vulnerability can be triggered by processing a malicious file over a network.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – A user must open or process a malicious file.
• Scope (S): Unchanged (S:U) – The exploit affects only the vulnerable component.
• Confidentiality (C): High (C:H) – Potential for arbitrary code execution.
• Integrity (I): High (I:H) – Code execution can modify data.
• Availability (A): High (A:H) – Exploit can cause denial of service.

Estimated CVSS 3.1 Score: 8.8 (High)

Threat Level: High – Due to the ease of exploitation and the critical role of Ghostscript in document processing.

Deep Dive & Mechanics

The vulnerability is a classic heap-based buffer overflow in the psi/zbfont.c file. The function responsible for converting glyphs to Unicode does not properly validate the size of the output buffer. When processing a specially crafted font or glyph, the conversion routine writes beyond the allocated buffer, corrupting adjacent memory.

Root Cause: In psi/zbfont.c, the glyph_to_unicode function (or similar) uses a fixed-size buffer without checking the length of the converted Unicode string. An attacker can supply a font with a glyph that, when converted, produces a Unicode string longer than the buffer, leading to an overflow.

Attack Vector: The attacker crafts a malicious PostScript or PDF file that includes a font with a specially designed glyph. When Ghostscript processes this file (e.g., during rendering or conversion), the overflow occurs.

Impact: Successful exploitation can lead to:

• Arbitrary code execution in the context of the Ghostscript process.
• Denial of service (crash).
• Potential for further exploitation if Ghostscript runs with elevated privileges.

Vulnerable vs. Patched Code

The vulnerable code in psi/zbfont.c likely resembles:

// Vulnerable code (pre-10.05.0)
void glyph_to_unicode(glyph_t glyph, char *out_buf) {
    char buf[256]; // Fixed-size buffer
    // ... conversion logic ...
    strcpy(buf, unicode_string); // No bounds check
    // ... copy to out_buf ...
}

The patched code in version 10.05.0 introduces proper bounds checking:

// Patched code (10.05.0+)
void glyph_to_unicode(glyph_t glyph, char *out_buf, size_t out_size) {
    char buf[256];
    // ... conversion logic ...
    if (strlen(unicode_string) >= sizeof(buf)) {
        // Handle error or truncate
        return;
    }
    strncpy(buf, unicode_string, sizeof(buf) - 1);
    buf[sizeof(buf) - 1] = '\0';
    // ... copy to out_buf with size check ...
}

The key fix is the addition of size parameters and bounds checks to prevent buffer overflows.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Ghostscript version < 10.05.0 installed.
• Ability to deliver a malicious PostScript or PDF file to the target.

Exploitation Steps:

1. Craft a Malicious Font: Create a PostScript file that defines a font with a glyph that, when converted to Unicode, produces a string longer than the expected buffer. This can be done by manipulating the font's encoding or glyph data.

2. Embed the Font in a PostScript File: Use the crafted font in a simple PostScript document that triggers the glyph-to-Unicode conversion.

3. Deliver the File: Send the malicious file to the target via email, web download, or other means.

4. Trigger the Vulnerability: When the target opens the file with Ghostscript (e.g., via gs malicious.ps), the buffer overflow occurs.

Example Malicious PostScript (Conceptual):

%!PS
/Courier findfont
[ /Encoding 256 array def
  0 1 255 { 1 index exch /.notdef put } for
  /Encoding exch def
  /FontType 3 def
  /FontMatrix [1 0 0 1 0 0] def
  /FontBBox [0 0 100 100] def
  /CharProcs 256 dict def
  CharProcs begin
    /.notdef { } bind def
    /A { 100 0 0 100 0 0 setcachedevice
         (A) show } bind def
    % ... other glyphs ...
  end
  /BuildGlyph {
    exch /CharProcs get exch 2 copy known not { pop /.notdef } if
    get exec
  } bind def
  /BuildChar {
    1 index /Encoding get exch get
    1 index /BuildGlyph get exec
  } bind def
>> definefont pop
/Courier findfont 12 scalefont setfont
(Test) show
showpage

Note: This is a simplified example. A real exploit would require precise manipulation of the font's glyph data to cause the overflow.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual Ghostscript processes or crashes.
• Use file scanning tools to detect malicious PostScript/PDF files.
• Implement network segmentation to limit exposure of Ghostscript instances.

Defense:

• Immediately upgrade to Ghostscript 10.05.0 or later.
• Use application whitelisting to prevent execution of untrusted Ghostscript binaries.
• Deploy endpoint detection and response (EDR) solutions to monitor for exploitation attempts.

Indicators of Compromise (IOCs)

• File Hashes: (None available at this time, but monitor for malicious PostScript/PDF files with unusual font structures.)
• Process Anomalies: Ghostscript processes crashing unexpectedly or consuming excessive memory.
• Network Traffic: Outbound connections from Ghostscript processes (if exploited for C2).
• Log Entries: Ghostscript error logs containing buffer overflow or memory corruption messages.

Detection Engineering

YARA Rule

rule CVE_2025_27835_Ghostscript_BOF {
    meta:
        description = "Detects malicious PostScript files exploiting CVE-2025-27835"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-27835"
    strings:
        $ps_header = "%!PS"
        $font_def = "definefont"
        $glyph_conv = "glyph_to_unicode" // May not be in file, but indicative
        $long_string = /[A-Za-z0-9]{300,}/ // Look for unusually long strings
    condition:
        $ps_header and $font_def and #long_string > 0
}

Sigma Rule

title: CVE-2025-27835 Ghostscript Buffer Overflow
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-27835 via Ghostscript crashes or abnormal behavior.
author: Valters IT
date: 2025-03-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\gs.exe'
        CommandLine|contains: 'malicious.ps'
    condition: selection
falsepositives:
    - Legitimate use of Ghostscript with similar filenames
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-27835 Ghostscript Buffer Overflow - Malicious PostScript Download"; flow:to_server,established; content:"%!PS"; http_client_body; content:"definefont"; http_client_body; content:"|00|"; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Ghostscript version 10.05.0 or later. This is the only complete fix.
2. Workaround: If patching is not immediately possible, disable processing of untrusted PostScript/PDF files. Use alternative tools like MuPDF or Poppler for document conversion.
3. Network Controls: Block inbound/outbound connections from Ghostscript processes if not required.

Long-Term Measures:

• Implement a robust patch management process for all dependencies.
• Use sandboxing or containerization for document processing services.
• Regularly audit software for known vulnerabilities using SBOM tools.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.