Moderate Vulnerability in Ghostscript: Heap Buffer Overflow via JPEG 2000 Output Adapter
Summary
RLSA-2026:74457: Moderate: ghostscript security update. Affects ghostscript versions < 0:9.54.0-19.el9_8.1. Fixed in 0:9.54.0-19.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats, enabling the display and printing of these documents. The package is widely used in various applications that require document processing and rendering capabilities. However, it has recently been identified to have a security vulnerability that could potentially lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2026-39919 is a heap buffer overflow that occurs through the JPEG 2000 output adapter in Ghostscript. This flaw allows an attacker to manipulate the memory allocation of the application, which can lead to arbitrary code execution, data corruption, or crashes. The severity of this vulnerability is underscored by its CVSS score of 7.8, indicating a high risk to systems utilizing this software.
How To Fix
Minimum fixed version
0:9.54.0-19.el9_8.1
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may consider disabling the JPEG 2000 output adapter if it is not critical to their operations. This can be done by modifying the Ghostscript configuration files to exclude this adapter until the update can be applied.
Conclusion
The Ghostscript vulnerability CVE-2026-39919 poses a significant risk due to its potential for arbitrary code execution. Users are strongly advised to update to the latest patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of software that interprets PostScript and PDF files, allowing for their rendering and processing.
It is a heap buffer overflow vulnerability that can lead to arbitrary code execution through the JPEG 2000 output adapter.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 7.8, indicating a high level of risk.
Consider disabling the JPEG 2000 output adapter as a temporary workaround until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
