CVE-2025-46646

MediumCVSS 4.5/10Last modified Jun 17, 2026

Description

In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-24

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-466475.3A vulnerability of plugin openid-connect in Apache APISIX. This vulnerability will only have an impact if all of the following conditions a CVE-2025-46659.6WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that CVE-2025-466514.3Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature. Due to insufficient val CVE-2025-466526.1In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Ma CVE-2025-466533.1Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable c CVE-2025-466544.9CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploadi CVE-2025-466554.9CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be by CVE-2025-466563.3python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This CVE-2025-466576.1Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI.CVE-2025-466589.8An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. There are verbose error messages.CVE-2025-466597.5An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. Information disclosure can occur via an external HTTPS request.CVE-2025-46666.4The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and inclu