Every CVE Search/ Get API key

CVE-2026-39919

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

9.3 CriticalFix available

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.85%Up 0.4 points since Sep 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.3

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Record
CVE-2026-39919
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2026-78584 9.3

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Record
EUVD-2026-78584
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-v865-hp77-22rm 9.3

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000...

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Record
GHSA-v865-hp77-22rm
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
NVD 9.3

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Record
CVE-2026-39919
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVALPINE-CVE-2026-39919 9.3

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Record
ALPINE-CVE-2026-39919
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-03
OSVBELL-CVE-2026-39919 9.8
Record
BELL-CVE-2026-39919
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 29 moreShow less
OSV 9.3

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Record
CVE-2026-39919
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2026-39919 9.3

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Record
DEBIAN-CVE-2026-39919
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVRHSA-2026:74457 7.8

Red Hat Security Advisory: ghostscript security update

Record
RHSA-2026:74457
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:74464 7.8

Red Hat Security Advisory: ghostscript security update

Record
RHSA-2026:74464
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:76877 7.8

Red Hat Security Advisory: ghostscript security update

Record
RHSA-2026:76877
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:74457 7.8

Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

  • ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:74457
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:74464 7.8

Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

  • ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:74464
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:76877 7.8

Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

  • ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:76877
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-39919 9.3

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Record
UBUNTU-CVE-2026-39919
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:74457 No score

Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

  • ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:74457
Updated
2026-11-02
OSVALSA-2026:74464 No score

Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

  • ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:74464
Updated
2026-11-02
OSVALSA-2026:76877 No score

Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

  • ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:76877
Updated
2026-11-02
OSVCLSA-2026-1791226276 No score

Fix CVE(s): CVE-2026-39919

  • SECURITY UPDATE: heap overflow in the JPEG 2000 output adapter
    • debian/patches/CVE-2026-39919.patch: stop the sub-byte-depth loop in process_one_trunk() writing one output byte per column of a sampled component, and reject unsupported bit depths in decode_image(), in base/sjpx_openjpeg.c.
    • CVE-2026-39919
Record
CLSA-2026-1791226276
Updated
2026-11-02
OSVCLSA-2026-1791294114 No score

ghostscript: Fix of 2 CVEs

  • CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter when components are subsampled below 8 bits per sample
  • CVE-2026-103226: bound the control stack in the Type 1 to Type 2 font conversion used by pdfwrite
  • CVE-2025-27830: count every $Blend procedure entry in the length and bound the formatting of its numbers so the serialized procedure cannot overflow its buffer (upstream Bug 706923 and gs_snprintf)
Record
CLSA-2026-1791294114
Updated
2026-11-02
OSVCLSA-2026-1791463004 No score

ghostscript: Fix of 3 CVEs

  • CVE-2026-39919: heap buffer overflow in the JPEG 2000 output adapter with subsampled components (base/sjpx_openjpeg.c)
  • CVE-2026-103226: stack buffer overflow in the pdfwrite Type 1 to Type 2 font converter control stack (devices/vector/gdevpsfx.c)
Record
CLSA-2026-1791463004
Updated
2026-11-02
OSVCLSA-2026-1792073622 No score

ghostscript: Fix of CVE-2026-39919

  • CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter with mismatched component subsampling
Record
CLSA-2026-1792073622
Updated
2026-11-02
OSVCLSA-2026-1792074631 No score

ghostscript: Fix of CVE-2026-39919

  • CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter with mismatched component subsampling
Record
CLSA-2026-1792074631
Updated
2026-11-02
OSVCLSA-2026-1792075420 No score

ghostscript: Fix of CVE-2026-39919

  • CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter with mismatched component subsampling
Record
CLSA-2026-1792075420
Updated
2026-11-02
OSVCLSA-2026-1792576567 No score

ghostscript: Fix of 2 CVEs

  • CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 decoder when components use different subsampling factors
Record
CLSA-2026-1792576567
Updated
2026-11-02
OSVCLSA-2026-1792576797 No score

ghostscript: Fix of CVE-2026-39919

  • CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 decoder when components use different subsampling factors
Record
CLSA-2026-1792576797
Updated
2026-11-02
OSVCLSA-2026-1792577303 No score

ghostscript: Fix of CVE-2026-39919

  • CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 decoder when components use different subsampling factors
Record
CLSA-2026-1792577303
Updated
2026-11-02
OSVMGASA-2026-0545 No score

Updated ghostscript package fixes a security vulnerability

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter. (CVE-2026-39919)

Record
MGASA-2026-0545
Updated
2026-11-02
OSVopenSUSE-SU-2026:11959-1 No score

ghostscript-10.08.0-1.1 on GA media

These are all security issues fixed in the ghostscript-10.08.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11959-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22063-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issue:

  • CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption by supplying crafted PDFs (bsc#1280620).

Changes for ghostscript:

  • Version upgrade to 10.08.0
Record
openSUSE-SU-2026:22063-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-39919 No score

CVE-2026-39919 in ghostscript - Patched by Root

Root has patched CVE-2026-39919 in the ghostscript package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-39919
Updated
2026-11-02
OSVSUSE-SU-2026:24214-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issue:

  • CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption by supplying crafted PDFs (bsc#1280620).

Changes for ghostscript:

  • Version upgrade to 10.08.0
Record
SUSE-SU-2026:24214-1
Updated
2026-11-02
OSVSUSE-SU-2026:4598-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issue:

  • CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption by supplying crafted PDFs (bsc#1280620).
Record
SUSE-SU-2026:4598-1
Updated
2026-11-02
OSVSUSE-SU-2026:4632-1 No score

Security update for ghostscript

This update for ghostscript fixes the following issue:

  • CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption by supplying crafted PDFs (bsc#1280620).
Record
SUSE-SU-2026:4632-1
Updated
2026-11-02
OSVUSN-8791-1 No score

ghostscript vulnerability

It was discovered that Ghostscript incorrectly handled JPEG 2000 image components with mismatched subsampling factors. An attacker could possibly use this issue to cause Ghostscript to crash or execute arbitrary code if it opened a specially crafted file.

Record
USN-8791-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ghostscript
Alpine:v3.23
 before 10.08.0-r0
10.08.0-r0
ghostscript
Alpine:v3.24
 before 10.08.0-r0
10.08.0-r0
ghostscript
AlmaLinux:9
 before 9.54.0-19.el9_8.1
9.54.0-19.el9_8.1
ghostscript-doc
AlmaLinux:9
 before 9.54.0-19.el9_8.1
9.54.0-19.el9_8.1
ghostscript-tools-dvipdf
AlmaLinux:9
 before 9.54.0-19.el9_8.1
9.54.0-19.el9_8.1
ghostscript-tools-fonts
AlmaLinux:9
 before 9.54.0-19.el9_8.1
9.54.0-19.el9_8.1
ghostscript-tools-printing
AlmaLinux:9
 before 9.54.0-19.el9_8.1
9.54.0-19.el9_8.1
ghostscript-x11
AlmaLinux:9
 before 9.54.0-19.el9_8.1
9.54.0-19.el9_8.1
libgs
AlmaLinux:9
 before 9.54.0-19.el9_8.1
9.54.0-19.el9_8.1
libgs-devel
AlmaLinux:9
 before 9.54.0-19.el9_8.1
9.54.0-19.el9_8.1
Show 121 moreShow less
Affected packages
PackageAffectedFixed
ghostscript
AlmaLinux:10
 before 10.02.1-16.el10_2.1
10.02.1-16.el10_2.1
ghostscript-doc
AlmaLinux:10
 before 10.02.1-16.el10_2.1
10.02.1-16.el10_2.1
ghostscript-tools-dvipdf
AlmaLinux:10
 before 10.02.1-16.el10_2.1
10.02.1-16.el10_2.1
ghostscript-tools-fonts
AlmaLinux:10
 before 10.02.1-16.el10_2.1
10.02.1-16.el10_2.1
ghostscript-tools-printing
AlmaLinux:10
 before 10.02.1-16.el10_2.1
10.02.1-16.el10_2.1
libgs
AlmaLinux:10
 before 10.02.1-16.el10_2.1
10.02.1-16.el10_2.1
libgs-devel
AlmaLinux:10
 before 10.02.1-16.el10_2.1
10.02.1-16.el10_2.1
ghostscript
AlmaLinux:8
 before 9.27-18.el8_10
9.27-18.el8_10
ghostscript-doc
AlmaLinux:8
 before 9.27-18.el8_10
9.27-18.el8_10
ghostscript-tools-dvipdf
AlmaLinux:8
 before 9.27-18.el8_10
9.27-18.el8_10
ghostscript-tools-fonts
AlmaLinux:8
 before 9.27-18.el8_10
9.27-18.el8_10
ghostscript-tools-printing
AlmaLinux:8
 before 9.27-18.el8_10
9.27-18.el8_10
ghostscript-x11
AlmaLinux:8
 before 9.27-18.el8_10
9.27-18.el8_10
libgs
AlmaLinux:8
 before 9.27-18.el8_10
9.27-18.el8_10
libgs-devel
AlmaLinux:8
 before 9.27-18.el8_10
9.27-18.el8_10
ghostscript
Alpaquita:23
 10.0.0-r0 up to 10.01.2-r6
10.01.2-r6
ghostscript
Alpaquita:25
 10.05.1-r0 up to 10.05.1-r1
10.05.1-r1
ghostscript
Alpaquita:stream
 10.0.0-r0 up to 10.08.0-r0
10.08.0-r0
ghostscript
TuxCare:Ubuntu:18.04
 before 9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
ghostscript-doc
TuxCare:Ubuntu:18.04
 before 9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
ghostscript-x
TuxCare:Ubuntu:18.04
 before 9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
libgs-dev
TuxCare:Ubuntu:18.04
 before 9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
libgs9
TuxCare:Ubuntu:18.04
 before 9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
libgs9-common
TuxCare:Ubuntu:18.04
 before 9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2
ghostscript
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 9.54.0-19.el9_6.tuxcare.els7
9.54.0-19.el9_6.tuxcare.els7
ghostscript-doc
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 9.54.0-19.el9_6.tuxcare.els7
9.54.0-19.el9_6.tuxcare.els7
ghostscript-gtk
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 9.54.0-19.el9_6.tuxcare.els7
9.54.0-19.el9_6.tuxcare.els7
ghostscript-tools-dvipdf
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 9.54.0-19.el9_6.tuxcare.els7
9.54.0-19.el9_6.tuxcare.els7
ghostscript-tools-fonts
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 9.54.0-19.el9_6.tuxcare.els7
9.54.0-19.el9_6.tuxcare.els7
ghostscript-tools-printing
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 9.54.0-19.el9_6.tuxcare.els7
9.54.0-19.el9_6.tuxcare.els7
ghostscript-x11
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 9.54.0-19.el9_6.tuxcare.els7
9.54.0-19.el9_6.tuxcare.els7
libgs
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 9.54.0-19.el9_6.tuxcare.els7
9.54.0-19.el9_6.tuxcare.els7
libgs-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 9.54.0-19.el9_6.tuxcare.els7
9.54.0-19.el9_6.tuxcare.els7
ghostscript
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 9.54.0-11.el9_2.tuxcare.els15
9.54.0-11.el9_2.tuxcare.els15
ghostscript-doc
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 9.54.0-11.el9_2.tuxcare.els15
9.54.0-11.el9_2.tuxcare.els15
ghostscript-gtk
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 9.54.0-11.el9_2.tuxcare.els15
9.54.0-11.el9_2.tuxcare.els15
ghostscript-tools-dvipdf
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 9.54.0-11.el9_2.tuxcare.els15
9.54.0-11.el9_2.tuxcare.els15
ghostscript-tools-fonts
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 9.54.0-11.el9_2.tuxcare.els15
9.54.0-11.el9_2.tuxcare.els15
ghostscript-tools-printing
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 9.54.0-11.el9_2.tuxcare.els15
9.54.0-11.el9_2.tuxcare.els15
ghostscript-x11
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 9.54.0-11.el9_2.tuxcare.els15
9.54.0-11.el9_2.tuxcare.els15
libgs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 9.54.0-11.el9_2.tuxcare.els15
9.54.0-11.el9_2.tuxcare.els15
libgs-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 9.54.0-11.el9_2.tuxcare.els15
9.54.0-11.el9_2.tuxcare.els15
ghostscript
TuxCare:CentOS:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript-cups
TuxCare:CentOS:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript-doc
TuxCare:CentOS:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript-gtk
TuxCare:CentOS:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
libgs
TuxCare:CentOS:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
libgs-devel
TuxCare:CentOS:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript
TuxCare:OracleLinux:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript-cups
TuxCare:OracleLinux:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript-doc
TuxCare:OracleLinux:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript-gtk
TuxCare:OracleLinux:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
libgs
TuxCare:OracleLinux:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
libgs-devel
TuxCare:OracleLinux:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript
TuxCare:RHEL:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript-cups
TuxCare:RHEL:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript-doc
TuxCare:RHEL:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript-gtk
TuxCare:RHEL:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
libgs
TuxCare:RHEL:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
libgs-devel
TuxCare:RHEL:7
 before 9.25-5.0.1.el7.tuxcare.els1
9.25-5.0.1.el7.tuxcare.els1
ghostscript
TuxCare:CentOS:8.4
 before 9.27-1.el8_4.tuxcare.els2
9.27-1.el8_4.tuxcare.els2
ghostscript-doc
TuxCare:CentOS:8.4
 before 9.27-1.el8_4.tuxcare.els2
9.27-1.el8_4.tuxcare.els2
ghostscript-gtk
TuxCare:CentOS:8.4
 before 9.27-1.el8_4.tuxcare.els2
9.27-1.el8_4.tuxcare.els2
ghostscript-tools-dvipdf
TuxCare:CentOS:8.4
 before 9.27-1.el8_4.tuxcare.els2
9.27-1.el8_4.tuxcare.els2
ghostscript-tools-fonts
TuxCare:CentOS:8.4
 before 9.27-1.el8_4.tuxcare.els2
9.27-1.el8_4.tuxcare.els2
ghostscript-tools-printing
TuxCare:CentOS:8.4
 before 9.27-1.el8_4.tuxcare.els2
9.27-1.el8_4.tuxcare.els2
ghostscript-x11
TuxCare:CentOS:8.4
 before 9.27-1.el8_4.tuxcare.els2
9.27-1.el8_4.tuxcare.els2
libgs
TuxCare:CentOS:8.4
 before 9.27-1.el8_4.tuxcare.els2
9.27-1.el8_4.tuxcare.els2
libgs-devel
TuxCare:CentOS:8.4
 before 9.27-1.el8_4.tuxcare.els2
9.27-1.el8_4.tuxcare.els2
ghostscript
TuxCare:CentOS:8.5
 before 9.27-1.el8_5.tuxcare.els2
9.27-1.el8_5.tuxcare.els2
ghostscript-doc
TuxCare:CentOS:8.5
 before 9.27-1.el8_5.tuxcare.els2
9.27-1.el8_5.tuxcare.els2
ghostscript-gtk
TuxCare:CentOS:8.5
 before 9.27-1.el8_5.tuxcare.els2
9.27-1.el8_5.tuxcare.els2
ghostscript-tools-dvipdf
TuxCare:CentOS:8.5
 before 9.27-1.el8_5.tuxcare.els2
9.27-1.el8_5.tuxcare.els2
ghostscript-tools-fonts
TuxCare:CentOS:8.5
 before 9.27-1.el8_5.tuxcare.els2
9.27-1.el8_5.tuxcare.els2
ghostscript-tools-printing
TuxCare:CentOS:8.5
 before 9.27-1.el8_5.tuxcare.els2
9.27-1.el8_5.tuxcare.els2
ghostscript-x11
TuxCare:CentOS:8.5
 before 9.27-1.el8_5.tuxcare.els2
9.27-1.el8_5.tuxcare.els2
libgs
TuxCare:CentOS:8.5
 before 9.27-1.el8_5.tuxcare.els2
9.27-1.el8_5.tuxcare.els2
libgs-devel
TuxCare:CentOS:8.5
 before 9.27-1.el8_5.tuxcare.els2
9.27-1.el8_5.tuxcare.els2
ghostscript
TuxCare:CentOS-Stream:8
 before 9.27-12.el8.tuxcare.els1
9.27-12.el8.tuxcare.els1
ghostscript-doc
TuxCare:CentOS-Stream:8
 before 9.27-12.el8.tuxcare.els1
9.27-12.el8.tuxcare.els1
ghostscript-gtk
TuxCare:CentOS-Stream:8
 before 9.27-12.el8.tuxcare.els1
9.27-12.el8.tuxcare.els1
ghostscript-tools-dvipdf
TuxCare:CentOS-Stream:8
 before 9.27-12.el8.tuxcare.els1
9.27-12.el8.tuxcare.els1
ghostscript-tools-fonts
TuxCare:CentOS-Stream:8
 before 9.27-12.el8.tuxcare.els1
9.27-12.el8.tuxcare.els1
ghostscript-tools-printing
TuxCare:CentOS-Stream:8
 before 9.27-12.el8.tuxcare.els1
9.27-12.el8.tuxcare.els1
ghostscript-x11
TuxCare:CentOS-Stream:8
 before 9.27-12.el8.tuxcare.els1
9.27-12.el8.tuxcare.els1
libgs
TuxCare:CentOS-Stream:8
 before 9.27-12.el8.tuxcare.els1
9.27-12.el8.tuxcare.els1
libgs-devel
TuxCare:CentOS-Stream:8
 before 9.27-12.el8.tuxcare.els1
9.27-12.el8.tuxcare.els1
ghostscript
Debian:12
 All versions, plus listed versions
10.0.0~dfsg-1110.0.0~dfsg-11+deb12u110.0.0~dfsg-11+deb12u210.0.0~dfsg-11+deb12u310.0.0~dfsg-11+deb12u4
Show 28 moreShow less
10.0.0~dfsg-11+deb12u510.0.0~dfsg-11+deb12u610.0.0~dfsg-11+deb12u710.0.0~dfsg-11+deb12u810.01.2~dfsg-110.02.0~dfsg-110.02.0~dfsg-210.02.1~dfsg-110.02.1~dfsg-210.02.1~dfsg-310.03.0~dfsg-110.03.1~dfsg-110.03.1~dfsg-210.03.1~dfsg~git20240518-110.04.0~dfsg-110.04.0~dfsg-210.05.0~dfsg-110.05.1~dfsg-110.05.1~dfsg-210.05.1~dfsg-310.06.0~dfsg-110.06.0~dfsg-210.06.0~dfsg-310.07.0~dfsg-110.07.0~dfsg-210.07.1~dfsg-110.08.0~dfsg-110.08.0~dfsg-2
 None known
ghostscript
Debian:13
 before 10.05.1~dfsg-1+deb13u2, plus listed versions
10.05.1~dfsg-110.05.1~dfsg-1+deb13u1
10.05.1~dfsg-1+deb13u2
ghostscript
Debian:14
 before 10.08.0~dfsg-1, plus listed versions
10.05.1~dfsg-110.05.1~dfsg-210.05.1~dfsg-310.06.0~dfsg-110.06.0~dfsg-2
Show 4 moreShow less
10.06.0~dfsg-310.07.0~dfsg-110.07.0~dfsg-210.07.1~dfsg-1
10.08.0~dfsg-1
ghostscript
Mageia:10
 before 10.08.0-1.mga10
10.08.0-1.mga10
libgs
Red Hat:enterprise_linux:9::appstream
 before 0:9.54.0-19.el9_8.1
0:9.54.0-19.el9_8.1
libgs
Red Hat:enterprise_linux:10.2
 before 0:10.02.1-16.el10_2.1
0:10.02.1-16.el10_2.1
ghostscript
Red Hat:enterprise_linux:8::appstream
 before 0:9.27-18.el8_10
0:9.27-18.el8_10
libgs
Red Hat:enterprise_linux:8::appstream
 before 0:9.27-18.el8_10
0:9.27-18.el8_10
ghostscript
Rocky Linux:9
 before 0:9.54.0-19.el9_8.1
0:9.54.0-19.el9_8.1
ghostscript
Rocky Linux:10
 before 0:10.02.1-16.el10_2.1
0:10.02.1-16.el10_2.1
ghostscript
Rocky Linux:8
 before 0:9.27-18.el8_10
0:9.27-18.el8_10
ghostscript
SUSE:Linux Enterprise Server 16.0
 before 10.08.0-160000.1.1
10.08.0-160000.1.1
ghostscript
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 10.08.0-160000.1.1
10.08.0-160000.1.1
ghostscript
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 9.52-23.100.1
9.52-23.100.1
ghostscript
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 9.52-23.100.1
9.52-23.100.1
ghostscript
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 9.52-150000.214.1
9.52-150000.214.1
ghostscript
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
9.16~dfsg~0-0ubuntu39.16~dfsg~0-0ubuntu49.18~dfsg~0-0ubuntu19.18~dfsg~0-0ubuntu29.18~dfsg~0-0ubuntu2.2
Show 33 moreShow less
9.18~dfsg~0-0ubuntu2.39.18~dfsg~0-0ubuntu2.49.18~dfsg~0-0ubuntu2.69.18~dfsg~0-0ubuntu2.79.18~dfsg~0-0ubuntu2.89.18~dfsg~0-0ubuntu2.99.25~dfsg+1-0ubuntu0.16.04.19.25~dfsg+1-0ubuntu0.16.04.29.25~dfsg+1-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.19.26~dfsg+0-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.49.26~dfsg+0-0ubuntu0.16.04.59.26~dfsg+0-0ubuntu0.16.04.69.26~dfsg+0-0ubuntu0.16.04.79.26~dfsg+0-0ubuntu0.16.04.89.26~dfsg+0-0ubuntu0.16.04.99.26~dfsg+0-0ubuntu0.16.04.109.26~dfsg+0-0ubuntu0.16.04.119.26~dfsg+0-0ubuntu0.16.04.129.26~dfsg+0-0ubuntu0.16.04.139.26~dfsg+0-0ubuntu0.16.04.149.26~dfsg+0-0ubuntu0.16.04.14+esm19.26~dfsg+0-0ubuntu0.16.04.14+esm29.26~dfsg+0-0ubuntu0.16.04.14+esm39.26~dfsg+0-0ubuntu0.16.04.14+esm49.26~dfsg+0-0ubuntu0.16.04.14+esm59.26~dfsg+0-0ubuntu0.16.04.14+esm69.26~dfsg+0-0ubuntu0.16.04.14+esm79.26~dfsg+0-0ubuntu0.16.04.14+esm89.26~dfsg+0-0ubuntu0.16.04.14+esm99.26~dfsg+0-0ubuntu0.16.04.14+esm109.26~dfsg+0-0ubuntu0.16.04.14+esm11
 None known
ghostscript
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.21~dfsg+1-0ubuntu39.22~dfsg+1-0ubuntu19.22~dfsg+1-0ubuntu1.19.22~dfsg+1-0ubuntu1.29.25~dfsg+1-0ubuntu0.18.04.1
Show 24 moreShow less
9.25~dfsg+1-0ubuntu0.18.04.29.26~dfsg+0-0ubuntu0.18.04.19.26~dfsg+0-0ubuntu0.18.04.39.26~dfsg+0-0ubuntu0.18.04.49.26~dfsg+0-0ubuntu0.18.04.59.26~dfsg+0-0ubuntu0.18.04.69.26~dfsg+0-0ubuntu0.18.04.79.26~dfsg+0-0ubuntu0.18.04.89.26~dfsg+0-0ubuntu0.18.04.99.26~dfsg+0-0ubuntu0.18.04.109.26~dfsg+0-0ubuntu0.18.04.119.26~dfsg+0-0ubuntu0.18.04.129.26~dfsg+0-0ubuntu0.18.04.139.26~dfsg+0-0ubuntu0.18.04.149.26~dfsg+0-0ubuntu0.18.04.159.26~dfsg+0-0ubuntu0.18.04.169.26~dfsg+0-0ubuntu0.18.04.179.26~dfsg+0-0ubuntu0.18.04.189.26~dfsg+0-0ubuntu0.18.04.18+esm19.26~dfsg+0-0ubuntu0.18.04.18+esm29.26~dfsg+0-0ubuntu0.18.04.18+esm39.26~dfsg+0-0ubuntu0.18.04.18+esm49.26~dfsg+0-0ubuntu0.18.04.18+esm59.26~dfsg+0-0ubuntu0.18.04.18+esm6
 None known
ghostscript
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
9.27~dfsg+0-0ubuntu39.27~dfsg+0-0ubuntu49.50~dfsg-5ubuntu19.50~dfsg-5ubuntu29.50~dfsg-5ubuntu3
Show 19 moreShow less
9.50~dfsg-5ubuntu49.50~dfsg-5ubuntu4.19.50~dfsg-5ubuntu4.29.50~dfsg-5ubuntu4.39.50~dfsg-5ubuntu4.49.50~dfsg-5ubuntu4.59.50~dfsg-5ubuntu4.69.50~dfsg-5ubuntu4.79.50~dfsg-5ubuntu4.89.50~dfsg-5ubuntu4.99.50~dfsg-5ubuntu4.109.50~dfsg-5ubuntu4.119.50~dfsg-5ubuntu4.129.50~dfsg-5ubuntu4.139.50~dfsg-5ubuntu4.149.50~dfsg-5ubuntu4.159.50~dfsg-5ubuntu4.15+esm19.50~dfsg-5ubuntu4.15+esm29.50~dfsg-5ubuntu4.15+esm3
 None known
ghostscript
Ubuntu:22.04:LTS
 before 9.55.0~dfsg1-0ubuntu5.14, plus listed versions
9.54.0~dfsg1-0ubuntu29.55.0~dfsg1-0ubuntu49.55.0~dfsg1-0ubuntu59.55.0~dfsg1-0ubuntu5.19.55.0~dfsg1-0ubuntu5.2
Show 10 moreShow less
9.55.0~dfsg1-0ubuntu5.39.55.0~dfsg1-0ubuntu5.49.55.0~dfsg1-0ubuntu5.59.55.0~dfsg1-0ubuntu5.69.55.0~dfsg1-0ubuntu5.79.55.0~dfsg1-0ubuntu5.99.55.0~dfsg1-0ubuntu5.109.55.0~dfsg1-0ubuntu5.119.55.0~dfsg1-0ubuntu5.129.55.0~dfsg1-0ubuntu5.13
9.55.0~dfsg1-0ubuntu5.14
ghostscript
Ubuntu:24.04:LTS
 before 10.02.1~dfsg1-0ubuntu7.9, plus listed versions
10.01.2~dfsg1-0ubuntu210.01.2~dfsg1-0ubuntu2.110.02.1~dfsg1-0ubuntu110.02.1~dfsg1-0ubuntu210.02.1~dfsg1-0ubuntu5
Show 9 moreShow less
10.02.1~dfsg1-0ubuntu610.02.1~dfsg1-0ubuntu710.02.1~dfsg1-0ubuntu7.110.02.1~dfsg1-0ubuntu7.310.02.1~dfsg1-0ubuntu7.410.02.1~dfsg1-0ubuntu7.510.02.1~dfsg1-0ubuntu7.610.02.1~dfsg1-0ubuntu7.710.02.1~dfsg1-0ubuntu7.8
10.02.1~dfsg1-0ubuntu7.9
ghostscript
Ubuntu:26.04:LTS
 before 10.06.0~dfsg-3ubuntu1.1, plus listed versions
10.05.0dfsg1-0ubuntu410.05.0dfsg1-0ubuntu510.06.0~dfsg-3ubuntu1
10.06.0~dfsg-3ubuntu1.1
ghostscript
openSUSE:Tumbleweed
 before 10.08.0-1.1
10.08.0-1.1
ghostscript
openSUSE:Leap 16.0
 before 10.08.0-160000.1.1
10.08.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-39919 is a critical vulnerability (CVSS 9.3) in Artifex Ghostscript, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in ghostscript 10.08.0-r0.

References

Show 43 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open