CVE-2026-39919: Ghostscript JPEG 2000 Heap Buffer Overflow

Overview

A critical heap-based buffer overflow has been disclosed in Ghostscript, the Artifex-maintained PostScript and PDF interpreter that underpins a huge slice of the open-source document-processing ecosystem. Tracked as CVE-2026-39919 and rated 9.8 (Critical) on CVSS 3.1, the flaw lives in Ghostscript's JPEG 2000 output adapter (base/sjpx_openjpeg.c) and can be triggered simply by getting a vulnerable installation to process a specially crafted PDF.

The bug was reserved on 2026-04-07 and publicly disclosed on 2026-09-15 (assigner: VulnCheck), tracked upstream at Ghostscript's own bug tracker as issue 709666. Artifex shipped the fix in Ghostscript 10.08.0, released 2026-09-08, so patched builds predate public disclosure by about a week — a narrow but real window in which distros and downstream packagers needed to catch up before details went wide.

Because Ghostscript is not typically installed and used interactively but rather invoked as a backend rasterizer by other software, this is the kind of vulnerability that tends to travel quietly through supply chains — CUPS printing filters, ImageMagick's PDF/PS delegate, LibreOffice's PDF import/export path, and countless mail and document gateways that rasterize attachments for preview or conversion. Any of these can inherit the exposure without an administrator ever having "Ghostscript" on their radar as installed software.

Technical Details

How It Works

The overflow is triggered when a JPEG 2000 image embedded in a PDF declares mismatched component subsampling factors — that is, the image's color components claim different sampling resolutions relative to one another, a legal-looking but unusual configuration in the JPEG 2000 bitstream. When Ghostscript's output adapter hits this "non-samescale" sub-byte-depth code path, it allocates a row buffer sized for tightly packed output, but the write loop then emits a full byte per output column regardless of the image's actual bit depth. The result is a write that overruns the allocated row buffer, corrupting adjacent heap chunk-allocator metadata.

Corrupting allocator metadata is a well-understood primitive for turning a memory-safety bug into something more useful than a crash: with the right heap layout and enough attacker control over the overflow contents, this class of bug can potentially be escalated from denial-of-service to arbitrary code execution in the context of the process running Ghostscript. We have not found a published proof-of-concept or evidence of in-the-wild exploitation as of this writing, and the CVE does not currently appear in CISA's Known Exploited Vulnerabilities catalog — but the combination of a pre-auth trigger, a common file format, and a widely embedded library makes this a vulnerability worth prioritizing rather than a theoretical curiosity.

Impact Assessment

Who Is At Risk

Any environment that feeds untrusted PDFs into a Ghostscript-backed pipeline is potentially exposed:

• Print servers and CUPS deployments that use Ghostscript filters to rasterize print jobs
• Document conversion and thumbnailing services that shell out to gs or link libgs
• ImageMagick installations where the PDF/PS delegate resolves to Ghostscript
• LibreOffice and other office suites that call Ghostscript for PDF import/export
• Mail and file-upload gateways that generate previews of attached or uploaded PDFs
• Linux distributions bundling Ghostscript below 10.08.0 in their stable repositories, until a backported fix lands

Potential Attack Chains

1. Delivery — Attacker emails, uploads, or otherwise submits a PDF containing a crafted JPEG 2000 image with mismatched subsampling factors.
2. Processing — A backend service (print filter, converter, preview generator, document scanner) automatically opens the PDF with Ghostscript.
3. Corruption — The malformed image triggers the row-buffer overflow, corrupting heap allocator metadata in the Ghostscript process.
4. Escalation — Depending on heap layout and attacker control, this may crash the service (denial of service) or be leveraged toward code execution in the context of the Ghostscript process — potentially the print spooler, mail gateway, or conversion worker's own privileges.

Mitigation

Immediate Actions

• Update to Ghostscript 10.08.0 or later wherever the binary or libgs is installed directly.
• Check downstream packages that vendor or statically link Ghostscript — CUPS filter packages, ImageMagick, LibreOffice, and PDF-processing containers may need their own updates or rebuilds even after the base ghostscript package is patched.
• Apply your distribution's backported fix if you track a stable/LTS release branch rather than upstream releases directly; consult your distro's security tracker for backport status before assuming you're covered.
• Where an immediate update is not possible, avoid processing untrusted PDFs through Ghostscript-backed pipelines, or route them through an isolated/sandboxed worker.

Detection Opportunities

• Monitor for unexpected crashes or restarts of gs, CUPS filter processes, ImageMagick workers, or document-conversion services — an unreliable exploit attempt will often manifest as a segfault before it manifests as anything else.
• Where feasible, log and inspect PDFs that fail to render or that produce abnormal Ghostscript error output, particularly those containing JPEG 2000 (.jp2/JPXDecode) image streams.
• Watch for anomalous child-process spawning from processes that host Ghostscript (print spoolers, mail gateways, conversion workers) as a potential post-exploitation indicator.

Defence-in-Depth

• Run Ghostscript-backed services with the least privilege necessary, and isolate print/conversion workers from sensitive filesystem paths and internal networks.
• Consider Ghostscript's built-in sandboxing options (such as restricted file-system access modes) for services that process untrusted input.
• Maintain an inventory of where Ghostscript is embedded transitively — it is easy to patch the package you know about and miss a vendored copy bundled inside another application or container image.

Background

Ghostscript has a long history as a high-value target precisely because of how broadly it is embedded rather than how often it is used directly. Its PostScript and PDF interpretation has powered printing subsystems, PDF converters, and image-processing pipelines for decades, and prior Ghostscript memory-safety and sandbox-escape issues have repeatedly been chained into real-world exploitation once integrated into a document-handling workflow. CVE-2026-39919's location inside the JPEG 2000 decode path is also consistent with a broader pattern: OpenJPEG-based decoding, wherever it appears, has been a recurring source of heap-safety bugs across multiple projects that embed it.

References

• NVD — CVE-2026-39919
• Ghostscript Bug Tracker — Issue 709666
• ghostpdl-downloads — Ghostscript 10.08.0 Release
• Ghostscript 10.08.0 Release Notes
• Ghostscript CVE Index