Critical Security Flaw in Ghostscript and libgs: CVE-2026-39919
Summary
RHSA-2026:76877: Red Hat Security Advisory: ghostscript security update. Affects ghostscript versions < 0:9.27-18.el8_10. Fixed in 0:9.27-18.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The libgs library is a core component of Ghostscript, providing essential functionalities for graphics and document processing. The vulnerability identified as CVE-2026-39919 poses significant risks to users of these packages, potentially allowing unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability CVE-2026-39919 originates from improper handling of certain inputs in Ghostscript, which can lead to memory corruption. This flaw can be exploited by attackers to execute arbitrary code, potentially compromising the integrity and confidentiality of the system. The severity of this vulnerability is underscored by its CVSS score of 7.8, indicating a high risk to affected systems.
How To Fix
Minimum fixed version
0:9.27-18.el8_10
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Ghostscript and libgs applications until the update is applied. This can be done by modifying user permissions or disabling the applications in environments where they are not essential.
Conclusion
The CVE-2026-39919 vulnerability in Ghostscript and libgs poses a significant risk to users, with the potential for severe consequences if exploited. It is crucial to update to the patched version to mitigate these risks. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2026-39919 is a security vulnerability in Ghostscript and libgs that can lead to memory corruption and potential arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2026-39919 is 7.8, indicating a high severity level.
If immediate updates are not possible, consider restricting access to the affected applications as a temporary workaround.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:76877.json.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
