A crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors can trigger a heap-based buffer overflow in Ghostscript versions before 10.08.0, which may lead to memory corruption and, according to the advisory, potentially to code execution.
What Is It
CVE-2026-39919 is a heap-based buffer overflow (CWE-122) in Ghostscript's JPEG 2000 output adapter, located in base/sjpx_openjpeg.c. The flaw is reached when an attacker supplies a crafted PDF holding a JPEG 2000 image whose components declare different subsampling values. In that non-samescale, sub-byte-depth output path, Ghostscript allocates a row buffer sized for packed output but then writes a full byte per output column regardless of bit depth. The write runs past the end of the allocation and corrupts internal chunk-allocator metadata; a mechanism the advisory characterizes as potentially sufficient to achieve code execution, though no public exploit demonstrating that outcome is documented in the source material.
The issue was disclosed via VulnCheck and carries a CVSS v3.1 base score of 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, alongside a CVSS v4.0 score of 9.3 (Critical).
Why It Matters
The scoring vector is the story here: network attack vector, low complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. The trigger is a document, a PDF, which is precisely the kind of untrusted input that flows into automated processing pipelines. Ghostscript is a common back-end component in print servers, document conversion services, and file-rendering workflows, so the attack surface is frequently reached without a human ever opening the file.
Note: this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog, and no confirmed in-the-wild exploitation is documented in the source material. Exploit maturity in the CVSS v4.0 vector is listed as Not Defined.
What's Vulnerable
- Vendor: Artifex Software
- Product: Ghostscript
- Affected versions: all versions before 10.08.0 (default status: affected)
No CPE entries were published with the record at the time of writing.
Patch Status
Fixed in Ghostscript 10.08.0. Upgrade to 10.08.0 or later. The upstream fix is available as commit 0a8bf88e39db07b0751a58d6ec1cf992073e4dc1 in the ghostpdl repository, and the release is published on the ghostpdl-downloads gs10080 tag. The record was published 2026-09-15 and remains in NVD status "Received," so analysis data may still change.