CVE-2025-27835

What it actually does

A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c of Ghostscript before 10.05.0, enabling memory corruption.

Why it matters to the business

Organizations running the listed Red Hat .NET packages on RHEL 7 face potential service disruption or compromise in document processing workflows until upgraded, with low immediate risk given minimal exploit activity and no ransomware usage.

How an attack unfolds

An attacker supplies a crafted input triggering the glyph-to-Unicode conversion path in vulnerable Ghostscript instances bundled or depended upon by the affected packages, aiming to corrupt memory for code execution or denial of service.

How to fix it

Upgrade each affected package to its listed fixed version, for example rh-dotnet21 to 0:2.1-7.el7, rh-dotnet22 to 0:2.2-3.el7, and similarly for all other listed dotnetcore and dotnet packages.

How to confirm the fix worked

Use yum or dnf to confirm installed versions match the fixed releases provided, and verify Ghostscript reports version 10.05.0 or later where directly accessible.

Typical attack path

1. Locate systems with vulnerable Red Hat dotnet packages on RHEL 7
2. Prepare malicious document or font data exploiting the buffer overflow
3. Cause the target application to process the input via Ghostscript
4. Trigger memory corruption leading to crash or code execution

How to detect it

Review application and system logs for Ghostscript crashes or errors during font or glyph handling on servers running the affected packages; inspect for unexpected process terminations after document processing.

What your security team should do

• Apply the exact fixed package versions across all RHEL 7 dotnet installations without delay
• Audit .NET applications for dependencies that invoke Ghostscript
• Monitor EPSS trend and re-evaluate if exploit maturity increases