CVE-2026-39919
CriticalCVSS 9.8Summary
Ghostscript before 10.08.0 contains a heap-based buffer overflow in the JPEG 2000 output adapter (base/sjpx_openjpeg.c). An attacker can cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. The issue is fixed in version 10.08.0.
Risk Assessment
Memory corruption and code execution are possible by processing a malicious PDF, potentially leading to compromise of the document-processing process. The risk is high in systems that automatically process user-supplied PDFs.
Recommendation
Upgrade Ghostscript to version 10.08.0 or later. Until then, avoid processing untrusted PDFs in high-privilege contexts.
Other vulnerabilities in Ghostscript
See all- CVE-2016-7976High
The PS Interpreter in Ghostscript versions 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.
- CVE-2016-8602High
The .sethalftone5 function in Ghostscript before version 9.21 allows remote attackers to cause application crashes or potentially execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.
- CVE-2016-10317High
The fill_threshhold_buffer function in base/gxht_thresh.c in Ghostscript 9.20 by Artifex Software, Inc. allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.
- CVE-2017-6196High
Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document.
- CVE-2016-7979Critical
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.
- CVE-2016-7978Critical
A use-after-free vulnerability in Ghostscript 9.20 may allow remote attackers to execute arbitrary code via reference leaks in the .setdevice function.
- CVE-2023-4042Medium
A flaw was found in ghostscript for Red Hat Enterprise Linux 8, where the fix for CVE-2020-16305 was not included as previously claimed. This issue affects the ghostscript package specifically.
- CVE-2023-38560Medium
An integer overflow flaw was found in pl_glyph_name in Ghostscript, which may allow a local attacker to cause a denial of service by transforming a crafted PCL file to PDF format.
- CVE-2023-38559Medium
A buffer overflow flaw was found in the devn_pcx_write_rle() function in Ghostscript, which may allow a local attacker to cause a denial of service by outputting a crafted PDF file for a DEVN device.
- CVE-2023-36664High
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
Original NVD description (English source)
Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.