Skip to content
OpenAdvisories
Medium ELSA-2026-74457 1 CVE

Moderate: ghostscript security update (Oracle Linux 9)

Published Oct 2, 2026 · Updated Oct 2, 2026

Ecosystem: Oracle Linux

Summary

[9.54.0-19.1]
- RHEL-264921 CVE-2026-39919 ghostscript: Heap buffer overflow in
JPEG 2000 (JPXDecode) output adapter

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 9 ghostscript 0:9.54.0-19.el9_8.1
Oracle Linux · 9 ghostscript-doc 0:9.54.0-19.el9_8.1
Oracle Linux · 9 ghostscript-tools-dvipdf 0:9.54.0-19.el9_8.1
Oracle Linux · 9 ghostscript-tools-fonts 0:9.54.0-19.el9_8.1
Oracle Linux · 9 ghostscript-tools-printing 0:9.54.0-19.el9_8.1
Oracle Linux · 9 ghostscript-x11 0:9.54.0-19.el9_8.1
Oracle Linux · 9 libgs 0:9.54.0-19.el9_8.1
Oracle Linux · 9 libgs-devel 0:9.54.0-19.el9_8.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-39919

    Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

    Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched comp…

    Artifex Ghostscript ghostscript ghostscript Debian Ubuntu Alpine