CVE-2026-39919
CVE-2026-39919 · Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.
CVSS 9.3 · Critical · EPSS 1.2% · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
ghostscript
- Versions
- ≥ 0, < 10.08.0: Affected (custom)
Update to 10.08.0
ghostscript Debian:12
- Versions
- 10.0.0~dfsg-11
- 10.0.0~dfsg-11+deb12u1
- 10.0.0~dfsg-11+deb12u2
- 10.0.0~dfsg-11+deb12u3
- 10.0.0~dfsg-11+deb12u4
- 10.0.0~dfsg-11+deb12u5
- 10.0.0~dfsg-11+deb12u6
- 10.0.0~dfsg-11+deb12u7
- 10.0.0~dfsg-11+deb12u8
- 10.01.2~dfsg-1
- 10.02.0~dfsg-1
- 10.02.0~dfsg-2
- 10.02.1~dfsg-1
- 10.02.1~dfsg-2
- 10.02.1~dfsg-3
- 10.03.0~dfsg-1
- 10.03.1~dfsg-1
- 10.03.1~dfsg-2
- 10.03.1~dfsg~git20240518-1
- 10.04.0~dfsg-1
- 10.04.0~dfsg-2
- 10.05.0~dfsg-1
- 10.05.1~dfsg-1
- 10.05.1~dfsg-2
- 10.05.1~dfsg-3
- 10.06.0~dfsg-1
- 10.06.0~dfsg-2
- 10.06.0~dfsg-3
- 10.07.0~dfsg-1
- 10.07.0~dfsg-2
- 10.07.1~dfsg-1
- 10.08.0~dfsg-1
- 10.08.0~dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ghostscript Debian:13
- Versions
- 10.05.1~dfsg-1
- 10.05.1~dfsg-1+deb13u1
- Affected ranges
- ECOSYSTEM: < 10.05.1~dfsg-1+deb13u2
Update to 10.05.1~dfsg-1+deb13u2
ghostscript Debian:14
- Versions
- 10.05.1~dfsg-1
- 10.05.1~dfsg-2
- 10.05.1~dfsg-3
- 10.06.0~dfsg-1
- 10.06.0~dfsg-2
- 10.06.0~dfsg-3
- 10.07.0~dfsg-1
- 10.07.0~dfsg-2
- 10.07.1~dfsg-1
- Affected ranges
- ECOSYSTEM: < 10.08.0~dfsg-1
Update to 10.08.0~dfsg-1
ghostscript Ubuntu:Pro:16.04:LTS
- Versions
- 9.16~dfsg~0-0ubuntu3
- 9.16~dfsg~0-0ubuntu4
- 9.18~dfsg~0-0ubuntu1
- 9.18~dfsg~0-0ubuntu2
- 9.18~dfsg~0-0ubuntu2.2
- 9.18~dfsg~0-0ubuntu2.3
- 9.18~dfsg~0-0ubuntu2.4
- 9.18~dfsg~0-0ubuntu2.6
- 9.18~dfsg~0-0ubuntu2.7
- 9.18~dfsg~0-0ubuntu2.8
- 9.18~dfsg~0-0ubuntu2.9
- 9.25~dfsg+1-0ubuntu0.16.04.1
- 9.25~dfsg+1-0ubuntu0.16.04.2
- 9.25~dfsg+1-0ubuntu0.16.04.3
- 9.26~dfsg+0-0ubuntu0.16.04.1
- 9.26~dfsg+0-0ubuntu0.16.04.3
- 9.26~dfsg+0-0ubuntu0.16.04.4
- 9.26~dfsg+0-0ubuntu0.16.04.5
- 9.26~dfsg+0-0ubuntu0.16.04.6
- 9.26~dfsg+0-0ubuntu0.16.04.7
- 9.26~dfsg+0-0ubuntu0.16.04.8
- 9.26~dfsg+0-0ubuntu0.16.04.9
- 9.26~dfsg+0-0ubuntu0.16.04.10
- 9.26~dfsg+0-0ubuntu0.16.04.11
- 9.26~dfsg+0-0ubuntu0.16.04.12
- 9.26~dfsg+0-0ubuntu0.16.04.13
- 9.26~dfsg+0-0ubuntu0.16.04.14
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm1
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm2
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm3
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm4
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm5
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm6
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm7
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm8
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm9
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm10
- 9.26~dfsg+0-0ubuntu0.16.04.14+esm11
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ghostscript Ubuntu:Pro:18.04:LTS
- Versions
- 9.21~dfsg+1-0ubuntu3
- 9.22~dfsg+1-0ubuntu1
- 9.22~dfsg+1-0ubuntu1.1
- 9.22~dfsg+1-0ubuntu1.2
- 9.25~dfsg+1-0ubuntu0.18.04.1
- 9.25~dfsg+1-0ubuntu0.18.04.2
- 9.26~dfsg+0-0ubuntu0.18.04.1
- 9.26~dfsg+0-0ubuntu0.18.04.3
- 9.26~dfsg+0-0ubuntu0.18.04.4
- 9.26~dfsg+0-0ubuntu0.18.04.5
- 9.26~dfsg+0-0ubuntu0.18.04.6
- 9.26~dfsg+0-0ubuntu0.18.04.7
- 9.26~dfsg+0-0ubuntu0.18.04.8
- 9.26~dfsg+0-0ubuntu0.18.04.9
- 9.26~dfsg+0-0ubuntu0.18.04.10
- 9.26~dfsg+0-0ubuntu0.18.04.11
- 9.26~dfsg+0-0ubuntu0.18.04.12
- 9.26~dfsg+0-0ubuntu0.18.04.13
- 9.26~dfsg+0-0ubuntu0.18.04.14
- 9.26~dfsg+0-0ubuntu0.18.04.15
- 9.26~dfsg+0-0ubuntu0.18.04.16
- 9.26~dfsg+0-0ubuntu0.18.04.17
- 9.26~dfsg+0-0ubuntu0.18.04.18
- 9.26~dfsg+0-0ubuntu0.18.04.18+esm1
- 9.26~dfsg+0-0ubuntu0.18.04.18+esm2
- 9.26~dfsg+0-0ubuntu0.18.04.18+esm3
- 9.26~dfsg+0-0ubuntu0.18.04.18+esm4
- 9.26~dfsg+0-0ubuntu0.18.04.18+esm5
- 9.26~dfsg+0-0ubuntu0.18.04.18+esm6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ghostscript Ubuntu:Pro:20.04:LTS
- Versions
- 9.27~dfsg+0-0ubuntu3
- 9.27~dfsg+0-0ubuntu4
- 9.50~dfsg-5ubuntu1
- 9.50~dfsg-5ubuntu2
- 9.50~dfsg-5ubuntu3
- 9.50~dfsg-5ubuntu4
- 9.50~dfsg-5ubuntu4.1
- 9.50~dfsg-5ubuntu4.2
- 9.50~dfsg-5ubuntu4.3
- 9.50~dfsg-5ubuntu4.4
- 9.50~dfsg-5ubuntu4.5
- 9.50~dfsg-5ubuntu4.6
- 9.50~dfsg-5ubuntu4.7
- 9.50~dfsg-5ubuntu4.8
- 9.50~dfsg-5ubuntu4.9
- 9.50~dfsg-5ubuntu4.10
- 9.50~dfsg-5ubuntu4.11
- 9.50~dfsg-5ubuntu4.12
- 9.50~dfsg-5ubuntu4.13
- 9.50~dfsg-5ubuntu4.14
- 9.50~dfsg-5ubuntu4.15
- 9.50~dfsg-5ubuntu4.15+esm1
- 9.50~dfsg-5ubuntu4.15+esm2
- 9.50~dfsg-5ubuntu4.15+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ghostscript Ubuntu:22.04:LTS
- Versions
- 9.54.0~dfsg1-0ubuntu2
- 9.55.0~dfsg1-0ubuntu4
- 9.55.0~dfsg1-0ubuntu5
- 9.55.0~dfsg1-0ubuntu5.1
- 9.55.0~dfsg1-0ubuntu5.2
- 9.55.0~dfsg1-0ubuntu5.3
- 9.55.0~dfsg1-0ubuntu5.4
- 9.55.0~dfsg1-0ubuntu5.5
- 9.55.0~dfsg1-0ubuntu5.6
- 9.55.0~dfsg1-0ubuntu5.7
- 9.55.0~dfsg1-0ubuntu5.9
- 9.55.0~dfsg1-0ubuntu5.10
- 9.55.0~dfsg1-0ubuntu5.11
- 9.55.0~dfsg1-0ubuntu5.12
- 9.55.0~dfsg1-0ubuntu5.13
- Affected ranges
- ECOSYSTEM: < 9.55.0~dfsg1-0ubuntu5.14
Update to 9.55.0~dfsg1-0ubuntu5.14
ghostscript Ubuntu:24.04:LTS
- Versions
- 10.01.2~dfsg1-0ubuntu2
- 10.01.2~dfsg1-0ubuntu2.1
- 10.02.1~dfsg1-0ubuntu1
- 10.02.1~dfsg1-0ubuntu2
- 10.02.1~dfsg1-0ubuntu5
- 10.02.1~dfsg1-0ubuntu6
- 10.02.1~dfsg1-0ubuntu7
- 10.02.1~dfsg1-0ubuntu7.1
- 10.02.1~dfsg1-0ubuntu7.3
- 10.02.1~dfsg1-0ubuntu7.4
- 10.02.1~dfsg1-0ubuntu7.5
- 10.02.1~dfsg1-0ubuntu7.6
- 10.02.1~dfsg1-0ubuntu7.7
- 10.02.1~dfsg1-0ubuntu7.8
- Affected ranges
- ECOSYSTEM: < 10.02.1~dfsg1-0ubuntu7.9
Update to 10.02.1~dfsg1-0ubuntu7.9
ghostscript Ubuntu:26.04:LTS
- Versions
- 10.05.0dfsg1-0ubuntu4
- 10.05.0dfsg1-0ubuntu5
- 10.06.0~dfsg-3ubuntu1
- Affected ranges
- ECOSYSTEM: < 10.06.0~dfsg-3ubuntu1.1
Update to 10.06.0~dfsg-3ubuntu1.1
Original sources
- https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080
- https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1
- https://bugs.ghostscript.com/show_bug.cgi?id=709666
- https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-2000-output-adapter
- https://nvd.nist.gov/vuln/detail/CVE-2026-39919