CVE-2026-39919

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

Published: Sep 15, 2026Updated: Sep 20, 2026 Sources: CVE List NVDCWE-122

9.8CRITICAL

Description

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

In plain language

AI Act now

Ghostscript versions earlier than 10.08.0 can be taken over through a malicious PDF, so small businesses using it should upgrade promptly.

Executive summary

Unauthenticated network-reachable remote code execution in Ghostscript through a heap buffer overflow triggered by a crafted PDF containing a JPEG 2000 image.

If affected, business impact

Server takeoverCustomer data exposureService disruptionRansomware risk

What to do now

Check whether your systems or applications use Ghostscript and confirm the installed version.
Upgrade Ghostscript to version 10.08.0 or later.
Until upgraded, prevent untrusted PDF files from being processed by Ghostscript and isolate any necessary document-processing service.

Patch / advisory Usually a quick update

What is it

This is a flaw in software used to process PDF and image files. A specially prepared PDF can make the software write outside its allotted space, like forcing extra items into an overfilled filing cabinet until it damages the surrounding office equipment and gives an intruder control.

Who is affected

This matters to you if your business runs Ghostscript directly or uses an application, print workflow, or document-processing service that includes it. It is especially relevant where Ghostscript processes PDFs received from customers, email, uploads, or other outside sources. It is a risk when the service is reachable through a network.

How urgent is it

Attackers can send a crafted PDF to a vulnerable Ghostscript service and potentially run code on that system, so this is a red-priority issue. No confirmed real-world exploitation or public exploit code is currently reported, but the impact warrants prompt remediation.

What to do — in detail

Confirm the installed Ghostscript version on every server, workstation, container, and document-processing application that invokes it, including bundled copies. Upgrade to Ghostscript 10.08.0 or later; the findings identify 10.08.0 as the fixed release and do not provide separate maintenance-branch fixes.

Test the upgrade against PDF conversion, printing, and image workflows before broad deployment, since application integrations may need validation. If upgrading is delayed, block untrusted PDFs from reaching Ghostscript or run the processing service in an isolated environment with minimal permissions and no access to sensitive data.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies. Monitor document-processing systems for Ghostscript crashes, unexpected processes launched by the service, and unusual activity following PDF submissions.

Technical context

CVE-2026-39919 is CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), a CWE-122 heap-based buffer overflow. A crafted PDF with a JPEG 2000 image can trigger memory corruption in the JPEG 2000 output adapter and enable remote code execution over the network without authentication or user interaction. EPSS is 0.5% (41st percentile) with a flat trend. It is not listed in CISA KEV, no clear dated in-the-wild exploitation claim is available, and no public exploit code is on record.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:HAvailability

High

Open in CVSS calculator →

Weaknesses

CWE-122

Affected Products

Artifex Software

commercialaka artifex

Ghostscript

OSS Libraries

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.

Is your org exposed to CVE-2026-39919?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Privilege Escalation

View detailed technique mapping

References

https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080

github.com

https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1

github.com

https://bugs.ghostscript.com/show_bug.cgi?id=709666

bugs.ghostscript.com

and 1 more references View all →

News mentions

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
en·The Hacker News·Sep 21, 2026 Exploited Cisco Identity Services Engine zero-day

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-39919 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows