CVE-2026-39919

A flaw was found in Ghostscript. This heap-based buffer overflow vulnerability in the JPEG 2000 output adapter allows an attacker to cause memory corruption by supplying a specially crafted PDF file. The crafted PDF contains a JPEG 2000 image with mismatched component subsampling factors. Successful exploitation could lead to arbitrary code execution.

This issue is rated Moderate because it requires processing a specially crafted PDF document containing a malformed JPEG 2000 image. Exploitation typically necessitates user interaction, such as opening a malicious file, which limits the attack vector compared to remotely exploitable vulnerabilities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, avoid processing untrusted or suspicious PDF documents with Ghostscript. Users should exercise caution when handling files from unknown or unverified sources.