Skip to content
OpenAdvisories
Medium ELSA-2026-76877 1 CVE

Moderate: ghostscript security update (Oracle Linux 8)

Published Oct 6, 2026 · Updated Oct 6, 2026

Ecosystem: Oracle Linux

Summary

[9.27-18]
- RHEL-264919 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 output adapter via component subsampling mismatch

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 8 ghostscript 0:9.27-18.el8_10
Oracle Linux · 8 ghostscript-doc 0:9.27-18.el8_10
Oracle Linux · 8 ghostscript-tools-dvipdf 0:9.27-18.el8_10
Oracle Linux · 8 ghostscript-tools-fonts 0:9.27-18.el8_10
Oracle Linux · 8 ghostscript-tools-printing 0:9.27-18.el8_10
Oracle Linux · 8 ghostscript-x11 0:9.27-18.el8_10
Oracle Linux · 8 libgs 0:9.27-18.el8_10
Oracle Linux · 8 libgs-devel 0:9.27-18.el8_10

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-39919

    Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

    Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched comp…

    Artifex Ghostscript ghostscript ghostscript Debian Ubuntu Alpine