Skip to content
OpenAdvisories
Medium ALSA-2026:74464 1 CVE

Moderate: ghostscript security update

Published Oct 1, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

* ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 7

ReleasePackageFixed in
AlmaLinux · 10 ghostscript 10.02.1-16.el10_2.1
AlmaLinux · 10 ghostscript-doc 10.02.1-16.el10_2.1
AlmaLinux · 10 ghostscript-tools-dvipdf 10.02.1-16.el10_2.1
AlmaLinux · 10 ghostscript-tools-fonts 10.02.1-16.el10_2.1
AlmaLinux · 10 ghostscript-tools-printing 10.02.1-16.el10_2.1
AlmaLinux · 10 libgs 10.02.1-16.el10_2.1
AlmaLinux · 10 libgs-devel 10.02.1-16.el10_2.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-39919

    Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

    Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched comp…

    Artifex Ghostscript ghostscript ghostscript Debian Ubuntu Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-39919
  • report
    https://bugzilla.redhat.com/2533857
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-74464.html