CVE-2007-6725

CVE-2007-6725 is a high-severity vulnerability in Ghostscript with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-119.

Key facts

• Severity: High (CVSS 2.0 base score 7.5)
• EPSS exploit prediction: 5% (91st percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Ghostscript
• Published: 2009-04-08
• Last modified: 2026-06-16

Description

The CCITTFax decoding filter in Ghostscript 8.60, 8.61, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file that triggers a buffer underflow in the cf_decode_2d function.

Frequently asked questions

What is CVE-2007-6725?

The CCITTFax decoding filter in Ghostscript 8.60, 8.61, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PDF file that triggers a buffer underflow in the cf_decode_2d function.

How severe is CVE-2007-6725?

CVE-2007-6725 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2007-6725 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (91st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-6725?

CVE-2007-6725 affects Ghostscript. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2007-6725?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2007-6725 published?

CVE-2007-6725 was published on 2009-04-08 and last updated on 2026-06-16.

References

• http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
• http://secunia.com/advisories/34726
• http://secunia.com/advisories/34729
• http://secunia.com/advisories/34732
• http://secunia.com/advisories/35416
• http://secunia.com/advisories/35559
• http://secunia.com/advisories/35569
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-262288-1
• http://support.avaya.com/elmodocs2/security/ASA-2009-155.htm
• http://wiki.rpath.com/Advisories:rPSA-2009-0060
• http://www.mail-archive.com/fedora-package-announce%40redhat.com/msg11830.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:095
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:096
• http://www.openwall.com/lists/oss-security/2009/04/01/10
• http://www.redhat.com/support/errata/RHSA-2009-0420.html
• http://www.redhat.com/support/errata/RHSA-2009-0421.html
• http://www.securityfocus.com/archive/1/502757/100/0/threaded
• http://www.securityfocus.com/bid/34337
• http://www.vupen.com/english/advisories/2009/1708
• https://bugzilla.redhat.com/show_bug.cgi?id=229174
• https://bugzilla.redhat.com/show_bug.cgi?id=493442
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9507
• https://usn.ubuntu.com/757-1/

Affected products (1)

• cpe:2.3:a:ghostscript:ghostscript:8.61:*:*:*:*:*:*:*

More vulnerabilities in Ghostscript

• CVE-2009-4270 — Critical (CVSS 9.3): Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript 8.64 through 8.70 allows remote…
• CVE-2009-0196 — Critical (CVSS 9.3): Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2 decoding library…
• CVE-2009-0792 — Critical (CVSS 9.3): Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in…
• CVE-2009-0584 — Critical (CVSS 9.3): icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier…
• CVE-2009-0583 — Critical (CVSS 9.3): Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in…
• CVE-2012-4405 — Medium (CVSS 6.8): Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library…

All CVEs affecting Ghostscript →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
• CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
• CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →