CVE-2026-39919

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

CVSS

9.3

EPSS

0.008 (54.8th percentile)

CISA KEV

Not listed

Exploitation

none

Public exploits

None seen

State

PUBLISHED

Coverage

• BleepingComputer◆Authoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards2 hours ago

  Ghostscript flaw lets hackers hijack servers via PDF uploads

  A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]

  ↗bleepingcomputer.com/news/security/ghostscript-…(opens the publisher's site in a new tab)

What we observed