Executive brief
Ghostscript is a widely-used application for processing PostScript and PDF documents. A heap buffer overflow in its JPEG 2000 decoder allows attackers to cause memory corruption and potentially achieve code execution by supplying a specially crafted PDF file with a JPEG 2000 image that has mismatched component subsampling factors. This vulnerability can be exploited remotely without authentication on systems that process untrusted PDF uploads.
Technical details
The vulnerability is a heap-based buffer overflow in the JPEG 2000 (JPXDecode) output adapter (base/sjpx_openjpeg.c) triggered when image components declare different subsampling factors. When the decoder detects a subsampling mismatch, it uses a non-samescale output path that allocates a row buffer sized for packed output but writes one full byte per output column regardless of bit depth, causing the buffer to overflow. The overflow overwrites chunk-allocator metadata immediately following the allocated buffer, corrupting free-tree pointers and size fields. Attack vector is network-based: processing a crafted PDF is sufficient, with no authentication required. An attacker can achieve arbitrary code execution through control of memory layout and corruption primitives. The vulnerability was fixed in Ghostscript 10.08.0, released in September 2026.
Affected products
- Artifex Software Ghostscript before 10.08.0
Timeline
- 2026-08-23: disclosed: Vulnerability reported to Ghostscript
- 2026-09-08: patched: Fixed in Ghostscript 10.08.0 release
- 2026-09-15: advisory: CVE-2026-39919 published