CVE-2026-39919 – Artifex Ghostscript
“One poisoned PDF is all it takes to turn a routine document job into an attacker's foothold.”
Artifex Software has released Ghostscript 10.08.0 to fix a heap-based buffer overflow in the JPEG 2000 output adapter. CVE-2026-39919 has a CVSS score of 9.8, Critical severity. An attacker can supply a crafted PDF with a JPEG 2000 image whose components declare mismatched subsampling factors. Ghostscript then sizes a row buffer for packed output but writes a full byte per column, which overflows the buffer and corrupts internal allocator metadata. The result is remote code execution.
Ghostscript often runs out of sight inside print servers, document converters, and preview services that handle untrusted files automatically. Any system that renders PDFs from outside sources is exposed until it runs 10.08.0 or later.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-122