CVE-2026-39919

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

No known exploitation. EPSS puts it in the 43rd percentile. No fix published yet.

CVSS 3.19.8Critical EPSS percentile43rd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-15Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your systems or applications use Ghostscript and confirm the installed version.
Upgrade Ghostscript to version 10.08.0 or later.
Until upgraded, prevent untrusted PDF files from being processed by Ghostscript and isolate any necessary document-processing service.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

In plain language

Written by AI from the record

Ghostscript versions earlier than 10.08.0 can be taken over through a malicious PDF, so small businesses using it should upgrade promptly.

Unauthenticated network-reachable remote code execution in Ghostscript through a heap buffer overflow triggered by a crafted PDF containing a JPEG 2000 image.

If you're affected

Server takeover
Customer data exposure
Service disruption
Ransomware risk

What is it

This is a flaw in software used to process PDF and image files. A specially prepared PDF can make the software write outside its allotted space, like forcing extra items into an overfilled filing cabinet until it damages the surrounding office equipment and gives an intruder control.

Who is affected

This matters to you if your business runs Ghostscript directly or uses an application, print workflow, or document-processing service that includes it. It is especially relevant where Ghostscript processes PDFs received from customers, email, uploads, or other outside sources. It is a risk when the service is reachable through a network.

How urgent is it

Attackers can send a crafted PDF to a vulnerable Ghostscript service and potentially run code on that system, so this is a red-priority issue. No confirmed real-world exploitation or public exploit code is currently reported, but the impact warrants prompt remediation.

What to do — in detail

Confirm the installed Ghostscript version on every server, workstation, container, and document-processing application that invokes it, including bundled copies. Upgrade to Ghostscript 10.08.0 or later; the findings identify 10.08.0 as the fixed release and do not provide separate maintenance-branch fixes.

Test the upgrade against PDF conversion, printing, and image workflows before broad deployment, since application integrations may need validation. If upgrading is delayed, block untrusted PDFs from reaching Ghostscript or run the processing service in an isolated environment with minimal permissions and no access to sensitive data.

CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so no CISA remediation due date applies. Monitor document-processing systems for Ghostscript crashes, unexpected processes launched by the service, and unusual activity following PDF submissions.

Technical context

CVE-2026-39919 is CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), a CWE-122 heap-based buffer overflow. A crafted PDF with a JPEG 2000 image can trigger memory corruption in the JPEG 2000 output adapter and enable remote code execution over the network without authentication or user interaction. EPSS is 0.5% (41st percentile) with a flat trend. It is not listed in CISA KEV, no clear dated in-the-wild exploitation claim is available, and no public exploit code is on record.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS43rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 43rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 9 days, from the signal feeds we watch.

2026-09-24Record updated
2026-09-20Record updated
2026-09-15Publishedweakness classified, att&ck mapped, record updated

Affected products

Artifex Softwarecommercialaka artifex
- GhostscriptOSS Libraries

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable