CVE-2026-39919

Ghostscript versions before 10.08.0 contain a heap-based buffer overflow in the JPEG 2000 output adapter (base/sjpx_openjpeg.c). When a crafted PDF embeds a JPEG 2000 image whose components declare mismatched subsampling factors, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata. Successful exploitation allows an attacker who can supply a document to the parser to achieve code execution with the privileges of the Ghostscript process, which is rated critical (CVSS 4.0: 9.3, network vector, no privileges or user interaction required). Any system or service that processes untrusted PDFs or images through Ghostscript is affected. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so exploitation is not currently observed.

What to do: Upgrade Ghostscript to 10.08.0 or later as soon as it is available from Artifex or your distribution's security channel (verify with `gs --version`). Audit and prioritize any service that renders or converts untrusted PDFs or images through Ghostscript — including print servers, document management systems, and image-processing APIs — since these are the realistic attack surface for a network-vector exploit with no authentication. As interim hardening, restrict which users or systems can submit documents to Ghostscript-based pipelines and monitor for crashes or anomalous behavior in gs processes until patched.