Artifex Ghostscript

• CVE-2026-103226 Medium 6.3 Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow 0.3%
• CVE-2025-59799 Medium 4.3 Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value. 0.2%
• CVE-2025-59800 Medium 4.3 In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8. 0.2%
• CVE-2025-59798 Medium 4.3 Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c. 0.2%
• CVE-2025-48708 Medium 4.0 gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext. 0.3%
• CVE-2025-46646 Medium 4.5 In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954. 0.2%