CVE-2025-48708

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-23 · updated 2026-06-17
Weakness: CWE-212

Description

gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext.

Affected products

Artifex Ghostscript: before 10.05.1 — fixed in 10.05.1

How to fix

Upgrade to a fixed version: Artifex Ghostscript 10.05.1. Check the vendor advisory for mitigations.

References

https://bugs.ghostscript.com/show_bug.cgi?id=708446
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=b587663c623b4462f9e78686a31fd880207303ee
http://www.openwall.com/lists/oss-security/2025/05/23/2

Get alerted when CVE-2025-48708 or the next vulnerability affects your stack