Skip to content
OpenAdvisories
Medium RLSA-2026:74457 1 CVE

Moderate: ghostscript security update

Published Oct 3, 2026 · Updated Oct 3, 2026

Ecosystem: Rocky Linux

Summary

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

* ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 ghostscript 0:9.54.0-19.el9_8.1

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-39919

    Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

    Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched comp…

    Artifex Ghostscript ghostscript ghostscript Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533857
  • advisory
    https://access.redhat.com/errata/RHSA-2026:74457