Moderate Vulnerability in Ghostscript: Heap Buffer Overflow via JPEG 2000 Output Adapter
Summary
ALSA-2026:74457: Moderate: ghostscript security update. Affects ghostscript versions < 9.54.0-19.el9_8.1. Fixed in 9.54.0-19.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats, enabling the display and printing of these documents. The package is widely used in various applications that require document processing and rendering capabilities. However, it has been identified to have a security vulnerability that could potentially compromise systems utilizing this software.
Vulnerability Detail
The vulnerability identified in Ghostscript is a heap buffer overflow that occurs via the JPEG 2000 output adapter. This issue arises from improper handling of input data, which can lead to memory corruption. If exploited, this vulnerability could allow an attacker to execute arbitrary code, potentially leading to unauthorized access or control over the affected system. The specific CVE associated with this vulnerability is CVE-2026-39919.
How To Fix
Minimum fixed version
9.54.0-19.el9_8.1
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling the JPEG 2000 output adapter if it is not essential for their operations. This can be done by modifying the Ghostscript configuration files to exclude this feature until the package is updated.
Conclusion
The Ghostscript vulnerability identified as CVE-2026-39919 poses a moderate risk due to a heap buffer overflow via the JPEG 2000 output adapter. Users are advised to update their Ghostscript packages to the latest version to mitigate this risk. Temporary workarounds are available, but updating is the most effective solution.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of software that interprets PostScript and PDF files, allowing for their rendering and manipulation.
A heap buffer overflow is a type of vulnerability that occurs when a program writes more data to a buffer located on the heap than it can hold, potentially leading to memory corruption.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, temporarily disabling the JPEG 2000 output adapter can serve as a workaround until the package is updated.
If immediate updates are not possible, ensure that your system is secured through other means, such as restricting access and monitoring for unusual activity.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
