Critical Ghostscript Flaw Enables Remote Code Execution via PDFs

Ghostscript has a critical heap buffer overflow, tracked as CVE-2026-39919, which could allow unauthenticated remote code execution. The vulnerability affects releases before 10.08.0 and has a CVSS v3 score of 9.8. It is triggered when Ghostscript processes a PDF containing a JPEG 2000 image with mismatched subsampling factors.

The flaw lies in the OpenJPEG image adapter in `base/sjpx_openjpeg.c`: a row buffer is allocated for packed output, while the decoder writes one full byte per column, causing an out-of-bounds write on each row.

According to the report, the overflow can corrupt metadata in Ghostscript’s custom memory allocator and potentially provide command execution on the host. The issue may affect servers and applications that use Ghostscript for document rendering, including systems generating PDF previews through ImageMagick. The article says researchers have produced a working proof of concept, but no exploitation in the wild has been confirmed. It also states that Ghostscript’s `-dSAFER` sandbox does not mitigate the memory-corruption attack.

Artifex Software fixed the vulnerability in Ghostscript 10.08.0. Administrators should upgrade to that version immediately; the article says there is no software workaround and recommends disabling automated PDF preview generation until patched. Analysts verified the defect in release builds 10.07.1 and 10.08.0rc1.