diff --git a/debian/changelog b/debian/changelog
index 9cfbbf7..d3a4803 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+ghostscript (10.05.1~dfsg-3deepin4) unstable; urgency=medium
+
+  * fix(cve): CVE-2025-59799 (medium) - [PATCH] pdfwrite - bounds check
+    some strings   Upstream:
+    https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226
+    c242ab7a83fa53e4b0ff781
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 04 Sep 2026 01:44:28 +0800
+
 ghostscript (10.05.1~dfsg-3deepin3) unstable; urgency=medium
 
   * fix(cve): CVE-2025-59798
diff --git a/debian/patches/CVE-2025-59799.patch b/debian/patches/CVE-2025-59799.patch
new file mode 100644
index 0000000..2ae82a7
--- /dev/null
+++ b/debian/patches/CVE-2025-59799.patch
@@ -0,0 +1,28 @@
+Description: CVE-2025-59799 (medium) - Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.
+Author: Piotr Kajda <petermasterperfect@gmail.com>
+Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226c242ab7a83fa53e4b0ff781
+Bug: https://security-tracker.debian.org/tracker/CVE-2025-59799
+Last-Update: 2025-05-08
+---
+diff --git a/devices/vector/gdevpdfm.c b/devices/vector/gdevpdfm.c
+index d1237c9..c120ba1 100644
+--- a/devices/vector/gdevpdfm.c
++++ b/devices/vector/gdevpdfm.c
+@@ -199,6 +199,8 @@ pdfmark_coerce_dest(gs_param_string *dstr, char dest[MAX_DEST_STRING])
+ {
+     const byte *data = dstr->data;
+     uint size = dstr->size;
++    if (size > MAX_DEST_STRING)
++        return_error(gs_error_limitcheck);
+     if (size == 0 || data[0] != '(')
+         return 0;
+     /****** HANDLE ESCAPES ******/
+@@ -859,6 +861,8 @@ pdfmark_put_ao_pairs(gx_device_pdf * pdev, cos_dict_t *pcd,
+             char buf[30];
+             int d0, d1;
+ 
++            if (Action[1].size > 29)
++                return_error(gs_error_rangecheck);
+             memcpy(buf, Action[1].data, Action[1].size);
+             buf[Action[1].size] = 0;
+             if (sscanf(buf, "%d %d R", &d0, &d1) == 2)
diff --git a/debian/patches/series b/debian/patches/series
index 8b22111..996a47b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -17,3 +17,4 @@
 CVE-2025-59798.patch
 CVE-2025-59801.patch
 CVE-2025-59800.patch
+CVE-2025-59799.patch