Moderate Vulnerability in Ghostscript: Heap Buffer Overflow via JPEG 2000 Output Adapter
Summary
RLSA-2026:76877: Moderate: ghostscript security update. Affects ghostscript versions < 0:9.27-18.el8_10. Fixed in 0:9.27-18.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats, enabling the display and printing of such documents. The package is widely used in various applications for document processing and printing tasks, making its security critical to prevent exploitation.
Vulnerability Detail
The vulnerability identified as CVE-2026-39919 is a heap buffer overflow that occurs through the JPEG 2000 output adapter in Ghostscript. This flaw can be exploited by attackers to execute arbitrary code, potentially leading to unauthorized access or system compromise. The severity of this vulnerability is underscored by its CVSS score of 7.8, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
0:9.27-18.el8_10
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the Ghostscript utility by restricting access to it or by ensuring that only trusted documents are processed. However, the best course of action is to apply the update as soon as possible.
Conclusion
The Ghostscript vulnerability CVE-2026-39919 poses a significant risk due to a heap buffer overflow that can be exploited by attackers. It is crucial for users to update to the patched version of Ghostscript to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of software that interprets PostScript and PDF files, allowing them to be rendered and printed.
A heap buffer overflow is a type of vulnerability that occurs when a program writes more data to a buffer located on the heap than it can hold, potentially leading to arbitrary code execution.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json to the Vulert playground, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, consider restricting access to Ghostscript and only processing trusted documents as a temporary workaround.
For detailed information about CVE-2026-39919, including its impact and mitigation strategies, refer to the CVE page linked in the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
