CVE-2026-39919: 
Ghostscript vulnerability analysis and mitigation

CVE-2026-39919 is a heap-based buffer overflow vulnerability in Ghostscript's JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows unauthenticated remote attackers to execute arbitrary code by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. All Ghostscript versions before 10.08.0 are affected. The vulnerability was disclosed on September 15, 2026, with a patch released in Ghostscript 10.08.0. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (Github Advisory, Feedly).

The root cause is a heap-based buffer overflow (CWE-122) in the process_one_trunk function within base/sjpx_openjpeg.c. When a JPEG 2000 image embedded in a PDF declares multiple components with differing subsampling factors (non-samescale) and a sub-byte bit depth (bpp < 8), the code allocates a row buffer sized for packed output but iterates state->width times writing a full byte per column — rather than per sample — overflowing the allocation. This corrupts internal chunk-allocator metadata, enabling controlled memory corruption and ultimately code execution. The vulnerability was reported by Alex Thomas of Wordfence Argus (AI) and the fix, committed as 0a8bf88, corrects the loop counter to track samples rather than bytes and adds a guard rejecting unsupported BPS values (Ghostscript Commit, Github Advisory).

Successful exploitation allows an unauthenticated network attacker to achieve arbitrary code execution on any system running a vulnerable Ghostscript version, with full confidentiality, integrity, and availability impact on the affected host. Because Ghostscript is widely embedded in document processing pipelines, print servers, web applications, and content management systems, exploitation could enable lateral movement, data exfiltration, or ransomware deployment. No user interaction is required, making automated or mass exploitation feasible against exposed services that process untrusted PDF files (Github Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is reported as 0.0, reflecting the early stage of public awareness. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. No threat actor attribution has been reported. The CVE was assigned by VulnCheck and the bug was tracked as Ghostscript bug #709666 (Ghostscript Bug).

1. Craft a malicious PDF: Create a PDF document embedding a JPEG 2000 (JP2) image that declares multiple image components with mismatched subsampling factors (e.g., component 0 with dx=1, component 1 with dx=2) and a sub-byte bit depth (bpp < 8, such as bpp=4).
2. Trigger vulnerable code path: Ensure the crafted JP2 image routes through the non-samescale, sub-byte-depth output path in process_one_trunk within base/sjpx_openjpeg.c when Ghostscript processes the PDF.
3. Cause heap overflow: The vulnerable loop iterates state->width times writing one full byte per iteration into a buffer allocated for packed (sub-byte) output, overflowing the heap allocation and corrupting adjacent chunk-allocator metadata.
4. Achieve code execution: Leverage the corrupted heap metadata to redirect execution flow — for example, by overwriting a function pointer or vtable entry — to attacker-controlled shellcode or a ROP chain.
5. Deliver the payload: Submit the crafted PDF to any service that invokes Ghostscript for processing (e.g., a web-based PDF converter, print server, or document management system) to trigger remote code execution without authentication or user interaction (Ghostscript Commit, Github Advisory).

• Network: Unexpected outbound connections from Ghostscript-processing services to external IPs following PDF ingestion; large or malformed PDF uploads to document processing endpoints.
• File System: Unexpected files written to Ghostscript working directories or temp folders; new executables or scripts created by the Ghostscript process user account.
• Logs: Application or web server logs showing PDF submissions with embedded JPEG 2000 images immediately preceding crashes or anomalous process behavior; Ghostscript error output referencing sjpx_openjpeg.c or JPEG 2000 decode failures.
• Process: Unusual child processes spawned by the Ghostscript (gs) process (e.g., shells, network utilities like curl, wget, or nc); Ghostscript process crashes (segmentation faults) when processing specific PDF files.

Upgrade Ghostscript to version 10.08.0 or later, which contains the fix committed in 0a8bf88 (Ghostscript Release). If immediate patching is not possible, restrict PDF processing to trusted sources only and implement input validation or filtering to reject PDFs containing JPEG 2000 images with suspicious component configurations. Consider sandboxing Ghostscript processes to limit the impact of exploitation. Monitor vendor and OS distribution channels for updated packages (Github Advisory, Feedly).

The vulnerability was reported by Alex Thomas of Wordfence Argus (AI), indicating AI-assisted security research contributed to its discovery (Ghostscript Commit). Early social media activity on Mastodon noted the disclosure shortly after publication. Automated vulnerability tracking platforms (VulnDB, CVEFeed, radar.offseq.com) indexed the CVE within hours of disclosure, reflecting standard community monitoring of Ghostscript vulnerabilities given its broad deployment footprint.