CVE-2025-46646: Medium severity ghostscript vulnerability
Published Apr 26, 2025
·Updated
In Artifex Ghostscript before 10.05.0, decodeutf8 in base/gputf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.
Affected Software
3 affected componentsFixes available
Artifex Ghostscript<10.05.0
debian/ghostscript
9.53.3~dfsg-7+deb11u79.53.3~dfsg-7+deb11u1010.0.0~dfsg-11+deb12u610.0.0~dfsg-11+deb12u710.05.0~dfsg-110.05.1~dfsg-1
Artifex Ghostscript<10.05.0
Remediation
Event History
Apr 26, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
RemedyAffected Software
May 5, 2025
Data Sourced
via Ubuntu·05:42 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-46646?
CVE-2025-46646 is considered a medium-severity vulnerability due to its potential impact on handling UTF-8 encoding.
2
How do I fix CVE-2025-46646?
To fix CVE-2025-46646, update Artifex Ghostscript to version 10.05.0 or later.
3
What systems are affected by CVE-2025-46646?
CVE-2025-46646 affects all versions of Artifex Ghostscript prior to 10.05.0.
4
What issues arise from CVE-2025-46646?
CVE-2025-46646 can lead to improper handling of overlong UTF-8 encoding, potentially causing security vulnerabilities.
5
Is CVE-2025-46646 related to any previous vulnerabilities?
Yes, CVE-2025-46646 exists because of an incomplete fix for CVE-2024-46954.