{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ghostscript--10.08.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-39919"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ghostscript (\u003c 10.08.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Artifex Software"],"content_html":"\u003cp\u003eGhostscript before version 10.08.0 contains a critical heap-based buffer overflow vulnerability within its JPEG 2000 output adapter, specifically located in the \u003ccode\u003ebase/sjpx_openjpeg.c\u003c/code\u003e file. This vulnerability is triggered when the software processes a maliciously crafted PDF document that includes a JPEG 2000 image with mismatched component subsampling factors.\u003c/p\u003e\n\u003cp\u003eWhen these image components declare conflicting subsampling values, the application triggers a faulty path in the non-samescale sub-byte-depth output logic. The system allocates a row buffer sized for packed output but proceeds to write a full byte per output column, regardless of the actual bit depth. This discrepancy leads to an out-of-bounds write that corrupts internal chunk-allocator metadata. Attackers can leverage this corruption to overwrite control structures or pointers, potentially achieving arbitrary code execution within the context of the user or service account running the Ghostscript binary.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on systems using Ghostscript for image or document processing. Given Ghostscript's common role as a backend component for web servers, document management systems, and print servers, the attack surface is significant. Exploitation can lead to full system compromise or unauthorized access to sensitive internal data processed by these applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering and security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all installations of Ghostscript to version 10.08.0 or later immediately to patch CVE-2026-39919.\u003c/li\u003e\n\u003cli\u003eAudit infrastructure to identify applications utilizing Ghostscript for PDF or image conversion, focusing on internet-facing web applications or document upload services.\u003c/li\u003e\n\u003cli\u003eImplement restrictive sandboxing or containerization for processes invoking the Ghostscript binary to limit the impact of potential exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-15T15:40:57Z","date_published":"2026-09-15T15:40:57Z","id":"https://feed.craftedsignal.io/briefs/2026-09-ghostscript-buffer-overflow/","summary":"Ghostscript versions prior to 10.08.0 are vulnerable to a heap-based buffer overflow in the JPEG 2000 output adapter (CVE-2026-39919), potentially allowing arbitrary code execution via a specially crafted PDF.","title":"Heap-Based Buffer Overflow in Ghostscript JPEG 2000 Output Adapter","url":"https://feed.craftedsignal.io/briefs/2026-09-ghostscript-buffer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Ghostscript (\u003c 10.08.0)","version":"https://jsonfeed.org/version/1.1"}