{"id":"CVE-2026-39919","aliases":["ALPINE-CVE-2026-39919","ALSA-2026:74457","ALSA-2026:74464","ALSA-2026:76877","BELL-CVE-2026-39919","CLSA-2026-1791226276","CLSA-2026-1791294114","CLSA-2026-1791463004","CLSA-2026-1792073622","CLSA-2026-1792074631","CLSA-2026-1792075420","CLSA-2026-1792576567","CLSA-2026-1792576797","CLSA-2026-1792577303","DEBIAN-CVE-2026-39919","EUVD-2026-78584","GHSA-v865-hp77-22rm","MGASA-2026-0545","RHSA-2026:74457","RHSA-2026:74464","RHSA-2026:76877","RLSA-2026:74457","RLSA-2026:74464","RLSA-2026:76877","ROOT-OS-DEBIAN-13-CVE-2026-39919","SUSE-SU-2026:24214-1","SUSE-SU-2026:4598-1","SUSE-SU-2026:4632-1","UBUNTU-CVE-2026-39919","USN-8791-1","openSUSE-SU-2026:11959-1","openSUSE-SU-2026:22063-1"],"status":"published","title":"Ghostscript \u003c 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00849,"percentile":0.58631,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-09-15T14:26:06Z","modified":"2026-11-03T06:33:02Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"ghostscript","fixed_in":["10.08.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ghostscript","fixed_in":["10.08.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"ghostscript","fixed_in":["9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"ghostscript-doc","fixed_in":["9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"ghostscript-tools-dvipdf","fixed_in":["9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"ghostscript-tools-fonts","fixed_in":["9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"ghostscript-tools-printing","fixed_in":["9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"ghostscript-x11","fixed_in":["9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libgs","fixed_in":["9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libgs-devel","fixed_in":["9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"ghostscript","fixed_in":["10.02.1-16.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"ghostscript-doc","fixed_in":["10.02.1-16.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"ghostscript-tools-dvipdf","fixed_in":["10.02.1-16.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"ghostscript-tools-fonts","fixed_in":["10.02.1-16.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"ghostscript-tools-printing","fixed_in":["10.02.1-16.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libgs","fixed_in":["10.02.1-16.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libgs-devel","fixed_in":["10.02.1-16.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript","fixed_in":["9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-doc","fixed_in":["9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-tools-dvipdf","fixed_in":["9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-tools-fonts","fixed_in":["9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-tools-printing","fixed_in":["9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"ghostscript-x11","fixed_in":["9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libgs","fixed_in":["9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libgs-devel","fixed_in":["9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"ghostscript","fixed_in":["10.01.2-r6"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"ghostscript","fixed_in":["10.05.1-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"ghostscript","fixed_in":["10.08.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"ghostscript","fixed_in":["9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"ghostscript-doc","fixed_in":["9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"ghostscript-x","fixed_in":["9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgs-dev","fixed_in":["9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgs9","fixed_in":["9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgs9-common","fixed_in":["9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"ghostscript","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"ghostscript-cups","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"ghostscript-doc","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"ghostscript-gtk","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"libgs","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"libgs-devel","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-cups","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-doc","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-gtk","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libgs","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"libgs-devel","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"ghostscript","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"ghostscript-cups","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"ghostscript-doc","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"ghostscript-gtk","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"libgs","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"libgs-devel","fixed_in":["9.25-5.0.1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript","fixed_in":["9.27-1.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-doc","fixed_in":["9.27-1.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-gtk","fixed_in":["9.27-1.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-tools-dvipdf","fixed_in":["9.27-1.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-tools-fonts","fixed_in":["9.27-1.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-tools-printing","fixed_in":["9.27-1.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-x11","fixed_in":["9.27-1.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libgs","fixed_in":["9.27-1.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libgs-devel","fixed_in":["9.27-1.el8_4.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript","fixed_in":["9.27-1.el8_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-doc","fixed_in":["9.27-1.el8_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-gtk","fixed_in":["9.27-1.el8_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-tools-dvipdf","fixed_in":["9.27-1.el8_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-tools-fonts","fixed_in":["9.27-1.el8_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-tools-printing","fixed_in":["9.27-1.el8_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-x11","fixed_in":["9.27-1.el8_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libgs","fixed_in":["9.27-1.el8_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libgs-devel","fixed_in":["9.27-1.el8_5.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript","fixed_in":["9.27-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-doc","fixed_in":["9.27-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-gtk","fixed_in":["9.27-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-tools-dvipdf","fixed_in":["9.27-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-tools-fonts","fixed_in":["9.27-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-tools-printing","fixed_in":["9.27-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-x11","fixed_in":["9.27-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libgs","fixed_in":["9.27-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libgs-devel","fixed_in":["9.27-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ghostscript","fixed_in":["10.05.1~dfsg-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["10.08.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"ghostscript","fixed_in":["10.08.0-1.mga10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgs","fixed_in":["0:9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgs","fixed_in":["0:10.02.1-16.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript","fixed_in":["0:9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libgs","fixed_in":["0:9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"ghostscript","fixed_in":["0:9.54.0-19.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"ghostscript","fixed_in":["0:10.02.1-16.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"ghostscript","fixed_in":["0:9.27-18.el8_10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"ghostscript","fixed_in":["10.08.0-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"ghostscript","fixed_in":["10.08.0-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"ghostscript","fixed_in":["9.52-23.100.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"ghostscript","fixed_in":["9.52-23.100.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ghostscript","fixed_in":["9.52-150000.214.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ghostscript","fixed_in":["9.55.0~dfsg1-0ubuntu5.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","fixed_in":["10.02.1~dfsg1-0ubuntu7.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"ghostscript","fixed_in":["10.06.0~dfsg-3ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","fixed_in":["10.08.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"ghostscript","fixed_in":["10.08.0-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1-16.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r0"},{"fixed":"10.01.2-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.05.1-r0"},{"fixed":"10.05.1-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r0"},{"fixed":"10.08.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"ghostscript-x","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgs-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgs9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgs9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26~dfsg+0-0ubuntu0.18.04.18+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-19.el9_6.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.54.0-11.el9_2.tuxcare.els15"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ghostscript-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ghostscript-cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.25-5.0.1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_4.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-1.el8_5.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0~dfsg-11","10.0.0~dfsg-11+deb12u1","10.0.0~dfsg-11+deb12u2","10.0.0~dfsg-11+deb12u3","10.0.0~dfsg-11+deb12u4","10.0.0~dfsg-11+deb12u5","10.0.0~dfsg-11+deb12u6","10.0.0~dfsg-11+deb12u7","10.0.0~dfsg-11+deb12u8","10.01.2~dfsg-1","10.02.0~dfsg-1","10.02.0~dfsg-2","10.02.1~dfsg-1","10.02.1~dfsg-2","10.02.1~dfsg-3","10.03.0~dfsg-1","10.03.1~dfsg-1","10.03.1~dfsg-2","10.03.1~dfsg~git20240518-1","10.04.0~dfsg-1","10.04.0~dfsg-2","10.05.0~dfsg-1","10.05.1~dfsg-1","10.05.1~dfsg-2","10.05.1~dfsg-3","10.06.0~dfsg-1","10.06.0~dfsg-2","10.06.0~dfsg-3","10.07.0~dfsg-1","10.07.0~dfsg-2","10.07.1~dfsg-1","10.08.0~dfsg-1","10.08.0~dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.05.1~dfsg-1+deb13u2"}]}],"versions":["10.05.1~dfsg-1","10.05.1~dfsg-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0~dfsg-1"}]}],"versions":["10.05.1~dfsg-1","10.05.1~dfsg-2","10.05.1~dfsg-3","10.06.0~dfsg-1","10.06.0~dfsg-2","10.06.0~dfsg-3","10.07.0~dfsg-1","10.07.0~dfsg-2","10.07.1~dfsg-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-1.mga10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.02.1-16.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.54.0-19.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.02.1-16.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-18.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-23.100.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-23.100.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.52-150000.214.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.16~dfsg~0-0ubuntu3","9.16~dfsg~0-0ubuntu4","9.18~dfsg~0-0ubuntu1","9.18~dfsg~0-0ubuntu2","9.18~dfsg~0-0ubuntu2.2","9.18~dfsg~0-0ubuntu2.3","9.18~dfsg~0-0ubuntu2.4","9.18~dfsg~0-0ubuntu2.6","9.18~dfsg~0-0ubuntu2.7","9.18~dfsg~0-0ubuntu2.8","9.18~dfsg~0-0ubuntu2.9","9.25~dfsg+1-0ubuntu0.16.04.1","9.25~dfsg+1-0ubuntu0.16.04.2","9.25~dfsg+1-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.1","9.26~dfsg+0-0ubuntu0.16.04.3","9.26~dfsg+0-0ubuntu0.16.04.4","9.26~dfsg+0-0ubuntu0.16.04.5","9.26~dfsg+0-0ubuntu0.16.04.6","9.26~dfsg+0-0ubuntu0.16.04.7","9.26~dfsg+0-0ubuntu0.16.04.8","9.26~dfsg+0-0ubuntu0.16.04.9","9.26~dfsg+0-0ubuntu0.16.04.10","9.26~dfsg+0-0ubuntu0.16.04.11","9.26~dfsg+0-0ubuntu0.16.04.12","9.26~dfsg+0-0ubuntu0.16.04.13","9.26~dfsg+0-0ubuntu0.16.04.14","9.26~dfsg+0-0ubuntu0.16.04.14+esm1","9.26~dfsg+0-0ubuntu0.16.04.14+esm2","9.26~dfsg+0-0ubuntu0.16.04.14+esm3","9.26~dfsg+0-0ubuntu0.16.04.14+esm4","9.26~dfsg+0-0ubuntu0.16.04.14+esm5","9.26~dfsg+0-0ubuntu0.16.04.14+esm6","9.26~dfsg+0-0ubuntu0.16.04.14+esm7","9.26~dfsg+0-0ubuntu0.16.04.14+esm8","9.26~dfsg+0-0ubuntu0.16.04.14+esm9","9.26~dfsg+0-0ubuntu0.16.04.14+esm10","9.26~dfsg+0-0ubuntu0.16.04.14+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.21~dfsg+1-0ubuntu3","9.22~dfsg+1-0ubuntu1","9.22~dfsg+1-0ubuntu1.1","9.22~dfsg+1-0ubuntu1.2","9.25~dfsg+1-0ubuntu0.18.04.1","9.25~dfsg+1-0ubuntu0.18.04.2","9.26~dfsg+0-0ubuntu0.18.04.1","9.26~dfsg+0-0ubuntu0.18.04.3","9.26~dfsg+0-0ubuntu0.18.04.4","9.26~dfsg+0-0ubuntu0.18.04.5","9.26~dfsg+0-0ubuntu0.18.04.6","9.26~dfsg+0-0ubuntu0.18.04.7","9.26~dfsg+0-0ubuntu0.18.04.8","9.26~dfsg+0-0ubuntu0.18.04.9","9.26~dfsg+0-0ubuntu0.18.04.10","9.26~dfsg+0-0ubuntu0.18.04.11","9.26~dfsg+0-0ubuntu0.18.04.12","9.26~dfsg+0-0ubuntu0.18.04.13","9.26~dfsg+0-0ubuntu0.18.04.14","9.26~dfsg+0-0ubuntu0.18.04.15","9.26~dfsg+0-0ubuntu0.18.04.16","9.26~dfsg+0-0ubuntu0.18.04.17","9.26~dfsg+0-0ubuntu0.18.04.18","9.26~dfsg+0-0ubuntu0.18.04.18+esm1","9.26~dfsg+0-0ubuntu0.18.04.18+esm2","9.26~dfsg+0-0ubuntu0.18.04.18+esm3","9.26~dfsg+0-0ubuntu0.18.04.18+esm4","9.26~dfsg+0-0ubuntu0.18.04.18+esm5","9.26~dfsg+0-0ubuntu0.18.04.18+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.27~dfsg+0-0ubuntu3","9.27~dfsg+0-0ubuntu4","9.50~dfsg-5ubuntu1","9.50~dfsg-5ubuntu2","9.50~dfsg-5ubuntu3","9.50~dfsg-5ubuntu4","9.50~dfsg-5ubuntu4.1","9.50~dfsg-5ubuntu4.2","9.50~dfsg-5ubuntu4.3","9.50~dfsg-5ubuntu4.4","9.50~dfsg-5ubuntu4.5","9.50~dfsg-5ubuntu4.6","9.50~dfsg-5ubuntu4.7","9.50~dfsg-5ubuntu4.8","9.50~dfsg-5ubuntu4.9","9.50~dfsg-5ubuntu4.10","9.50~dfsg-5ubuntu4.11","9.50~dfsg-5ubuntu4.12","9.50~dfsg-5ubuntu4.13","9.50~dfsg-5ubuntu4.14","9.50~dfsg-5ubuntu4.15","9.50~dfsg-5ubuntu4.15+esm1","9.50~dfsg-5ubuntu4.15+esm2","9.50~dfsg-5ubuntu4.15+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.55.0~dfsg1-0ubuntu5.14"}]}],"versions":["9.54.0~dfsg1-0ubuntu2","9.55.0~dfsg1-0ubuntu4","9.55.0~dfsg1-0ubuntu5","9.55.0~dfsg1-0ubuntu5.1","9.55.0~dfsg1-0ubuntu5.2","9.55.0~dfsg1-0ubuntu5.3","9.55.0~dfsg1-0ubuntu5.4","9.55.0~dfsg1-0ubuntu5.5","9.55.0~dfsg1-0ubuntu5.6","9.55.0~dfsg1-0ubuntu5.7","9.55.0~dfsg1-0ubuntu5.9","9.55.0~dfsg1-0ubuntu5.10","9.55.0~dfsg1-0ubuntu5.11","9.55.0~dfsg1-0ubuntu5.12","9.55.0~dfsg1-0ubuntu5.13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1~dfsg1-0ubuntu7.9"}]}],"versions":["10.01.2~dfsg1-0ubuntu2","10.01.2~dfsg1-0ubuntu2.1","10.02.1~dfsg1-0ubuntu1","10.02.1~dfsg1-0ubuntu2","10.02.1~dfsg1-0ubuntu5","10.02.1~dfsg1-0ubuntu6","10.02.1~dfsg1-0ubuntu7","10.02.1~dfsg1-0ubuntu7.1","10.02.1~dfsg1-0ubuntu7.3","10.02.1~dfsg1-0ubuntu7.4","10.02.1~dfsg1-0ubuntu7.5","10.02.1~dfsg1-0ubuntu7.6","10.02.1~dfsg1-0ubuntu7.7","10.02.1~dfsg1-0ubuntu7.8"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0~dfsg-3ubuntu1.1"}]}],"versions":["10.05.0dfsg1-0ubuntu4","10.05.0dfsg1-0ubuntu5","10.06.0~dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.55.0~dfsg1-0ubuntu5.14"}]}],"versions":["9.54.0~dfsg1-0ubuntu2","9.55.0~dfsg1-0ubuntu4","9.55.0~dfsg1-0ubuntu5","9.55.0~dfsg1-0ubuntu5.1","9.55.0~dfsg1-0ubuntu5.2","9.55.0~dfsg1-0ubuntu5.3","9.55.0~dfsg1-0ubuntu5.4","9.55.0~dfsg1-0ubuntu5.5","9.55.0~dfsg1-0ubuntu5.6","9.55.0~dfsg1-0ubuntu5.7","9.55.0~dfsg1-0ubuntu5.9","9.55.0~dfsg1-0ubuntu5.10","9.55.0~dfsg1-0ubuntu5.11","9.55.0~dfsg1-0ubuntu5.12","9.55.0~dfsg1-0ubuntu5.13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1~dfsg1-0ubuntu7.9"}]}],"versions":["10.01.2~dfsg1-0ubuntu2","10.01.2~dfsg1-0ubuntu2.1","10.02.1~dfsg1-0ubuntu1","10.02.1~dfsg1-0ubuntu2","10.02.1~dfsg1-0ubuntu5","10.02.1~dfsg1-0ubuntu6","10.02.1~dfsg1-0ubuntu7","10.02.1~dfsg1-0ubuntu7.1","10.02.1~dfsg1-0ubuntu7.3","10.02.1~dfsg1-0ubuntu7.4","10.02.1~dfsg1-0ubuntu7.5","10.02.1~dfsg1-0ubuntu7.6","10.02.1~dfsg1-0ubuntu7.7","10.02.1~dfsg1-0ubuntu7.8"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.06.0~dfsg-3ubuntu1.1"}]}],"versions":["10.05.0dfsg1-0ubuntu4","10.05.0dfsg1-0ubuntu5","10.06.0~dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.08.0-160000.1.1"}]}]}],"products":[{"vendor":"artifex","product":"ghostscript"},{"vendor":"artifex software","product":"ghostscript"}],"references":[{"url":"https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080","tags":["release-notes","advisory","article"]},{"url":"https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1","tags":["patch","fix","article"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709666","tags":["issue-tracking","report","article"]},{"url":"https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-2000-output-adapter","tags":["third-party-advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39919","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v865-hp77-22rm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-39919","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74457","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39919","tags":["report"]},{"url":"https://bugzilla.redhat.com/2533857","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-74457.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74464","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-74464.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76877","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-76877.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-39919","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1791226276.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791294114.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103226","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791463004.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46646","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792073622.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792074631.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792075420.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1792576567.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28879","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1792576797.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1792577303.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39919.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-39919","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0545.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36404","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00429.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533857","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74457.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39919","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74464.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76877.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:74457","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:74464","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:76877","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624214-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280620","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39919","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264598-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264632-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-39919","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8791-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-39919","title":"Ghostscript \u003c 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.","status":"published","published":"2026-09-15T14:26:06.697Z","modified":"2026-10-01T15:19:56.598Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:20:02.662847Z"}],"euvd":[{"id":"EUVD-2026-78584","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.","status":"published","published":"2026-09-15T14:26:06Z","modified":"2026-10-01T15:19:56Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:27:45.358437Z"}],"ghsa":[{"id":"GHSA-v865-hp77-22rm","title":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000...","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.","status":"published","published":"2026-09-15T15:32:11Z","modified":"2026-09-15T15:32:20Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:11:54.134441Z"}],"nvd":[{"id":"CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.","status":"published","published":"2026-09-15T15:17:14.723Z","modified":"2026-09-24T21:04:40.34Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"ALPINE-CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.","status":"published","published":"2026-09-15T15:17:14.723Z","modified":"2026-11-03T06:33:02.655897633Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2026-39919","status":"published","published":"2026-09-18T06:05:43.96436Z","modified":"2026-10-22T08:30:03.42950737Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CVE-2026-39919","title":"Ghostscript \u003c 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.","status":"published","published":"2026-09-15T14:26:06.697Z","modified":"2026-11-11T13:23:10.62131136Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-11T11:06:44.829133Z"},{"id":"DEBIAN-CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.","status":"published","published":"2026-09-15T15:17:14.723Z","modified":"2026-09-27T10:00:06.404089985Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"RHSA-2026:74457","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2026-10-02T10:25:53Z","modified":"2026-10-20T10:15:34Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74464","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2026-10-02T10:25:54Z","modified":"2026-10-20T10:15:34Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76877","title":"Red Hat Security Advisory: ghostscript security update","status":"published","published":"2026-10-07T10:20:15Z","modified":"2026-10-20T10:16:04Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:74457","title":"Moderate: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-03T12:04:21.220866Z","modified":"2026-10-03T12:30:02.53333662Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:74464","title":"Moderate: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-02T12:08:50.579322Z","modified":"2026-10-02T12:30:03.975449317Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:76877","title":"Moderate: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-07T06:01:37.070463Z","modified":"2026-10-07T06:30:02.467145893Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-39919","description":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-10-21T23:02:20.211116186Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"ALSA-2026:74457","title":"Moderate: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-10-29T11:32:37.418118107Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:74464","title":"Moderate: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-01T00:00:00Z","modified":"2026-10-29T11:30:59.740231495Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:76877","title":"Moderate: ghostscript security update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.  \n\nSecurity Fix(es):  \n\n  * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-29T11:02:29.748359137Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"CLSA-2026-1791226276","title":"Fix CVE(s): CVE-2026-39919","description":"   * SECURITY UPDATE: heap overflow in the JPEG 2000 output adapter\n     - debian/patches/CVE-2026-39919.patch: stop the sub-byte-depth loop in\n       process_one_trunk() writing one output byte per column of a sampled\n       component, and reject unsupported bit depths in decode_image(), in\n       base/sjpx_openjpeg.c.\n     - CVE-2026-39919","status":"published","published":"2026-10-05T18:51:29Z","modified":"2026-10-26T09:32:03.824111046Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791294114","title":"ghostscript: Fix of 2 CVEs","description":"- CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter when\n  components are subsampled below 8 bits per sample\n- CVE-2026-103226: bound the control stack in the Type 1 to Type 2 font\n  conversion used by pdfwrite\n- CVE-2025-27830: count every $Blend procedure entry in the length and bound\n  the formatting of its numbers so the serialized procedure cannot overflow\n  its buffer (upstream Bug 706923 and gs_snprintf)","status":"published","published":"2026-10-06T13:42:05Z","modified":"2026-10-26T09:43:45.632876618Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791463004","title":"ghostscript: Fix of 3 CVEs","description":"- CVE-2026-39919: heap buffer overflow in the JPEG 2000 output adapter\n  with subsampled components (base/sjpx_openjpeg.c)\n- CVE-2026-103226: stack buffer overflow in the pdfwrite Type 1 to Type\n  2 font converter control stack (devices/vector/gdevpsfx.c)","status":"published","published":"2026-10-23T23:29:56Z","modified":"2026-10-26T09:43:14.575613145Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792073622","title":"ghostscript: Fix of CVE-2026-39919","description":"- CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter\n  with mismatched component subsampling","status":"published","published":"2026-10-17T12:58:56Z","modified":"2026-10-26T09:31:43.659171596Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792074631","title":"ghostscript: Fix of CVE-2026-39919","description":"- CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter\n  with mismatched component subsampling","status":"published","published":"2026-10-15T14:30:41Z","modified":"2026-10-26T09:31:46.305352429Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792075420","title":"ghostscript: Fix of CVE-2026-39919","description":"- CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 output adapter\n  with mismatched component subsampling","status":"published","published":"2026-10-15T14:43:51Z","modified":"2026-10-26T09:32:01.262907537Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792576567","title":"ghostscript: Fix of 2 CVEs","description":"- CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 decoder when\n  components use different subsampling factors","status":"published","published":"2026-10-21T17:13:45Z","modified":"2026-10-26T09:31:44.062307147Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792576797","title":"ghostscript: Fix of CVE-2026-39919","description":"- CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 decoder when\n  components use different subsampling factors","status":"published","published":"2026-10-21T10:00:08Z","modified":"2026-10-26T09:31:52.127250386Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792577303","title":"ghostscript: Fix of CVE-2026-39919","description":"- CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 decoder when components use different subsampling factors","status":"published","published":"2026-10-21T10:08:33Z","modified":"2026-10-26T09:31:38.598190728Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"MGASA-2026-0545","title":"Updated ghostscript package fixes a security vulnerability","description":"Ghostscript \u003c 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter.\n(CVE-2026-39919)\n","status":"published","published":"2026-10-26T15:28:20Z","modified":"2026-10-26T15:30:03.186986973Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11959-1","title":"ghostscript-10.08.0-1.1 on GA media","description":"These are all security issues fixed in the ghostscript-10.08.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:09.338588297Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22063-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issue:\n\n- CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption\n  by supplying crafted PDFs (bsc#1280620).\n\nChanges for ghostscript:\n\n- Version upgrade to 10.08.0\n","status":"published","published":"2026-10-09T06:34:50Z","modified":"2026-10-19T17:23:10.659569543Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-39919","title":"CVE-2026-39919 in ghostscript - Patched by Root","description":"Root has patched CVE-2026-39919 in the ghostscript package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T12:04:40Z","modified":"2026-10-08T13:00:07.319986039Z","updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"SUSE-SU-2026:24214-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issue:\n\n- CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption\n  by supplying crafted PDFs (bsc#1280620).\n\nChanges for ghostscript:\n\n- Version upgrade to 10.08.0\n","status":"published","published":"2026-10-09T06:34:41Z","modified":"2026-10-21T17:23:09.533632666Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4598-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issue:\n\n- CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption\n  by supplying crafted PDFs (bsc#1280620).\n","status":"published","published":"2026-10-08T22:03:35Z","modified":"2026-10-09T18:15:04.418724001Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4632-1","title":"Security update for ghostscript","description":"This update for ghostscript fixes the following issue:\n\n- CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows attackers to cause memory corruption\n  by supplying crafted PDFs (bsc#1280620).\n","status":"published","published":"2026-10-12T15:27:50Z","modified":"2026-10-13T10:30:06.865146463Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8791-1","title":"ghostscript vulnerability","description":"It was discovered that Ghostscript incorrectly handled JPEG 2000 image\ncomponents with mismatched subsampling factors. An attacker could\npossibly use this issue to cause Ghostscript to crash or execute\narbitrary code if it opened a specially crafted file.","status":"published","published":"2026-09-21T12:51:18Z","modified":"2026-09-21T21:42:45.261003169Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}