CVE-2026-39919

Name of the Vulnerable Software and Affected Versions Ghostscript versions prior to 10.08.0

Description A heap-based buffer overflow exists in the JPEG 2000 output adapter within the base/sjpx openjpeg.c file. The issue occurs when processing a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. In such cases, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth. This results in memory corruption of internal chunk-allocator metadata, which can lead to a process crash or remote code execution.

Recommendations Update to version 10.08.0.