Moderate Vulnerability in Ghostscript: Heap Buffer Overflow via JPEG 2000 Output Adapter
Summary
RLSA-2026:74464: Moderate: ghostscript security update. Affects ghostscript versions < 0:10.02.1-16.el10_2.1. Fixed in 0:10.02.1-16.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats, enabling the display and printing of these documents. As a widely used tool in various applications, Ghostscript's security is crucial to prevent exploitation that could compromise systems and data.
Vulnerability Detail
The vulnerability identified as CVE-2026-39919 is a heap buffer overflow that occurs through the JPEG 2000 output adapter in Ghostscript. This flaw can potentially allow an attacker to execute arbitrary code, leading to unauthorized access or control over the affected system. The severity of this vulnerability is underscored by its CVSS score of 7.8, indicating a significant risk to users who have not applied the necessary updates.
How To Fix
Minimum fixed version
0:10.02.1-16.el10_2.1
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the JPEG 2000 output adapter until the update is applied. This may involve modifying the Ghostscript configuration to disable this specific output option.
Conclusion
The Ghostscript vulnerability CVE-2026-39919 presents a significant risk due to a heap buffer overflow that can be exploited via the JPEG 2000 output adapter. Users are strongly advised to update to the latest patched version to ensure their systems remain secure. Temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability is a heap buffer overflow that can be exploited through the JPEG 2000 output adapter, potentially allowing arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, consider disabling the JPEG 2000 output adapter as a temporary workaround to mitigate the risk.
The CVSS score for this vulnerability is 7.8, indicating a moderate to high level of risk.
The Rocky Enterprise Software Foundation and Red Hat are responsible for providing updates and patches for Ghostscript.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
