CVE-2025-27836

What it actually does

Buffer overflow in the Print buffer of the BJ10V device in contrib/japanese/gdev10v.c allows memory corruption during processing of crafted input in Ghostscript before 10.05.0.

Why it matters to the business

Systems handling untrusted documents on the affected Red Hat appliance face risk of remote code execution, potentially leading to full system compromise, data loss, or unauthorized access; prevalence in document workflows amplifies operational disruption.

How an attack unfolds

An attacker supplies a specially crafted file that triggers the buffer overflow in the BJ10V device when Ghostscript processes it, enabling arbitrary code execution on the target system.

How to fix it

Upgrade Ghostscript to 10.05.0 or later; for rhvm-appliance update to version 2:4.2-20190129.0.el7.

How to confirm the fix worked

Confirm Ghostscript version meets or exceeds 10.05.0 and verify rhvm-appliance package is updated to 2:4.2-20190129.0.el7; test processing of sample inputs for absence of overflow conditions.

Typical attack path

1. Locate systems running vulnerable Ghostscript on affected Red Hat appliance
2. Craft malicious input targeting the BJ10V device buffer
3. Deliver the file to a document processing workflow
4. Trigger Ghostscript processing with the BJ10V device
5. Exploit overflow to execute attacker-controlled code

How to detect it

Review system and application logs for Ghostscript crashes or unexpected BJ10V device activity during file processing; inspect process execution patterns for anomalies around document handling.

What your security team should do

• Apply the fixed package version to rhvm-appliance without delay given the publication age
• Inventory all Ghostscript deployments and restrict untrusted file processing until patched
• Monitor EPSS trend and re-evaluate if exploit maturity increases