External risk intelligence

Ghostscript JPEG 2000 Output Adapter Heap Buffer Overflow.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-39919

Ghostscript is a document processing library typically invoked by backend applications or local utilities to render or convert files. While it can be reached via network-facing upload services in some environments, it is not a standalone network service, edge gateway, or public-facing portal by design.

Buffer Overflow

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Ghostscript, a software component used for processing PostScript and PDF files. The issue, a heap-based buffer overflow, can be triggered by specially crafted documents containing a specific type of image. This could allow unauthorized access and manipulation of memory, potentially leading to code execution. The main concern is confirming if this component is used and exposed within our environment.

Document processing software has a critical flaw.
Protects against potential unauthorized access.
Confirm relevance and exposure of this software.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by providing a specially crafted PDF document that includes a malicious JPEG 2000 image. When Ghostscript processes this PDF, it attempts to render the image. Due to an error in handling differing subsampling factors within the JPEG 2000 output adapter, a heap-based buffer overflow occurs, corrupting memory and potentially leading to code execution.

No authentication or user interaction needed.
Triggered by processing a crafted PDF.
Allows for code execution.

Live Threat

Current exploitation, exposure, and threat context

When Ghostscript processes a crafted PDF containing a malicious JPEG 2000 image, it could lead to memory corruption and potentially code execution on the system. This could occur if the component subsampling factors within the image data are mismatched, triggering an overflow in the output adapter.

System memory corruption and code execution.
Crafted PDF with mismatched image data.
Compromise of the processing system.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determining ownership for this Ghostscript vulnerability requires identifying which teams manage document processing workflows or applications that directly incorporate the library. The first actionable step is to locate all instances of the affected Ghostscript version, assess their exposure and criticality, and then engage the accountable system or application owner to plan remediation, potentially involving vendor coordination if applicable.

Identify application owners and affected systems.
Verify network reachability and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ghostscript?

Ghostscript is a powerful software interpreter suite used to process and render PostScript and PDF files. It serves as an underlying engine for many applications, utilities, and backend systems that need to convert, display, or print complex documents. Because it handles various image formats and document structures, it is often integrated into larger workflows that process user-supplied files.

What is the memory vulnerability in CVE-2026-39919?

This is a heap-based buffer overflow, categorized as CWE-122. It occurs in the JPEG 2000 output adapter when the software miscalculates the space needed for image data. Specifically, if a PDF contains a JPEG 2000 image with mismatched component subsampling factors, the software writes more data than the allocated memory buffer can hold. This overflow overwrites adjacent memory, which can corrupt internal system data and potentially allow an attacker to execute their own code.

How is this Ghostscript vulnerability triggered?

The vulnerability is triggered when Ghostscript processes a specially crafted PDF document that contains a malicious JPEG 2000 image. The flaw specifically activates when the image's component subsampling factors do not match. Simply having the Ghostscript software installed is not enough to be compromised; the software must actively parse a document containing this specific, malformed image data to trigger the overflow path.

Is my system at risk for CVE-2026-39919?

Risk depends on how your applications use Ghostscript. According to Halo Surface Signal, Ghostscript is typically a backend library rather than a direct network service, making widespread public exposure less likely. However, if your environment uses Ghostscript to process files uploaded by users or from external sources, the risk is higher. You should assess whether your internal applications expose this library to untrusted input processing.

What steps should I take to manage this risk?

Start by identifying all applications or automated workflows in your environment that rely on Ghostscript for document processing. Once you locate the systems using affected versions, prioritize them based on their exposure to untrusted files. Coordinate with the owners of these specific applications to verify their usage, check for available software updates to the patched version, and plan a maintenance window to implement the necessary remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.