CVE-2026-39919: Ghostscript Flaw Allows Unauthenticated Remote Code Execution

TL;DR

VulnCheck discovered a critical heap memory corruption vulnerability tracked as CVE-2026-39919 in Ghostscript. Attackers can exploit this weakness by submitting crafted PDF documents to trigger unauthenticated remote code execution. Administrators must upgrade immediately to Ghostscript version 10.08.0 to protect their environments.

Why This Threat Matters

Sourced estimates indicate that millions of Linux distributions and web applications rely on Ghostscript for document rendering. Furthermore, popular content management platforms utilize Ghostscript via ImageMagick to generate PDF thumbnails. An unpatched Ghostscript buffer overflow exposes internet-facing servers to immediate danger. Therefore, an unauthenticated visitor uploading a document can trigger the vulnerability without user interaction. If attackers exploit this defect, they gain native shell access on the host system. In addition, intruders can access private server directories and extract sensitive corporate data.

How the Attack Works

The security defect resides within the OpenJPEG image adapter in the base/sjpx_openjpeg.c source file. Specifically, the flaw triggers when Ghostscript processes a PDF containing a JPEG 2000 image with mismatched subsampling factors. The advisory explains: “When image components declare different subsampling factors, the adapter selects its non-samescale output path.”

Under this specific code path, the application allocates a row buffer sized only for packed output. However, the decoding loop writes a full byte per column instead of packing the data. This discrepancy causes the decoder to write past the allocated memory buffer on every single row. The resulting overflow corrupts internal free-node metadata inside Ghostscript’s custom chunk allocator.

Crucially, standard sandboxing protections cannot stop this attack. The technical advisory emphasizes: “Because execution is achieved by corrupting memory rather than by invoking any PostScript-level operator, -dSAFER does not mitigate it.” Consequently, attackers gain reliable command execution on the host. Security researchers confirmed that no in-the-wild exploitation has been detected. However, researchers successfully produced a functional proof-of-concept demonstrating remote code execution.

Affected Versions

This Ghostscript buffer overflow impacts all software releases prior to version 10.08.0. Analysts verified the defect on release builds 10.07.1 and 10.08.0rc1.

Patch and Mitigation Steps

Administrators must upgrade their installations immediately to eliminate this critical vulnerability. Artifex Software resolved the flaw in the official Ghostscript 10.08.0 release. Furthermore, system engineers can inspect the technical analysis in the vulnerability report.

Currently, there are no software workarounds available for this issue. Enabling the standard -dSAFER flag does not prevent exploitation. Therefore, applying the vendor update represents the only complete defense. Administrators managing web servers should disable automated PDF preview generation until they install the patched binaries.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.