Post

🚨8 months after public disclosure, RHEL @almalinux.org @rockylinux.org are still vulnerable for a Ghostscript RCE with a reliable public exploit (CVE-2025-27835 and others)! It can be triggered by opening LibreOffice docs or through a server that uses ImageMagick for file conversion!

RedTeam Pentesting

@redteam-pentesting.de

13 Nov 2025

Red Hat is aware, but they chose not to fix it. They also assigned a low CVSS score 5.5 because it is supposed to be "only exploitable locally" even though many web apps process uploaded documents using Ghostscript: access.redhat.com/security/cve...

access.redhat.comcve-details

RedTeam Pentesting

@redteam-pentesting.de

This is neither the first, nor the second time that we can't get distros to apply upstream fixes for publicly disclosed RCEs with POCs available in Ghostscript. x.com/RedTeamPT/st...

x.comRedTeam Pentesting on X: "🚨 Another month, another critical Ghostscript RCE, with patches rolling out rather slowly to some distros again 👻😱 #infosec #DeprecateUntrustedPostscript" / X🚨 Another month, another critical Ghostscript RCE, with patches rolling out rather slowly to some distros again 👻😱 #infosec #DeprecateUntrustedPostscript

13/11/25, 8:59 am0 reposts0 likes

RedTeam Pentesting

@redteam-pentesting.de

13 Nov 2025

Disclaimer: We did not discover this vulnerability (credits go to zhutyra🎉), we're just wondering why we can still exploit these vulnerabilities in pentests on patched systems 🤷 We received no response on the RHEL bug tracker: bugzilla.redhat.com/show_bug.cgi...

bugzilla.redhat.com2354947 – (CVE-2025-27835) CVE-2025-27835 Ghostscript: Buffer overflow when converting glyphs to unicode