CVE-2025-27832

What it actually does

Buffer overflow in the NPDL device compression handling within contrib/japanese/gdevnpdl.c allows memory corruption during PostScript or PDF processing.

Why it matters to the business

Organizations using affected Red Hat Satellite versions risk service disruptions or remote code execution in document rendering workflows, increasing operational downtime and potential compromise of content management systems.

How an attack unfolds

An attacker supplies a specially crafted input file that invokes the NPDL device, overflowing the compression buffer to corrupt memory and potentially execute arbitrary code or cause denial of service.

How to fix it

Upgrade all affected packages to the specified fixed versions including satellite 0:6.5.3.2-1.el7sat, satellite-capsule 0:6.5.3.2-1.el7sat, candlepin 0:2.5.22-1.el7sat and equivalent satellite-cli, satellite-common, satellite-debug-tools updates; verify Ghostscript reaches at least 10.05.0.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases listed for each Red Hat Satellite component and test Ghostscript with sample NPDL inputs to ensure no overflow occurs.

Typical attack path

1. Identify systems running vulnerable Ghostscript versions bundled in Red Hat Satellite
2. Craft malicious PostScript/PDF targeting the NPDL device
3. Deliver the file through document processing or print workflows
4. Trigger buffer overflow to achieve memory corruption or code execution

How to detect it

Search system and application logs for Ghostscript invocations with NPDL device flags, unexpected crashes during PDF/PostScript jobs, or error messages referencing gdevnpdl.c; monitor process execution for unusual Ghostscript child processes handling Japanese or compression-related inputs.

What your security team should do

• Prioritize patching all listed Satellite packages to the exact fixed versions within the next maintenance window
• Restrict untrusted document processing jobs that invoke Ghostscript devices
• Review logging for any prior Ghostscript crashes involving NPDL or Japanese output paths