CVE-2026-39919: Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter
Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpxopenjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by supplying a crafted PDF that contains a JPEG 2000 image with mismatched component subsampling factors. Exploitation does not require user interaction or privileges according to the supplied vector.
Which Ghostscript deployments are affected?
Ghostscript versions before 10.08.0 are affected. The vulnerable code is the JPEG 2000 output adapter in base/sjpx_openjpeg.c.
What is the impact of successful exploitation?
The crafted image can trigger a heap buffer overflow that corrupts internal chunk-allocator metadata. The described outcome is memory corruption leading to code execution.