Ghostscript Vulnerability CVE-2026-39919: Critical Heap Overflow
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- CRITICAL
- CVSS
- 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Affected component
- ghostscript (other)
- Affected versions
- >= ghostpdl-10.05.0-test-base-001, <= ghostpdl-10.05.0-test-base-001 or >= robin_test_ref, <= robin_test_ref or >= ghostpdl-10.01.1-gse-10174, <= ghostpdl-10.01.1-gse-10174 or >= ghostpdl-10.02.0-test-base-001, <= ghostpdl-10.02.0-test-base-001 or >= ken_20220210_baseline, <= ken_20220210_baseline or >= ghostpdl-9.56.0-test-base-5, <= ghostpdl-9.56.0-test-base-5 or >= ghostpdl-9.56.0-test-base-4, <= ghostpdl-9.56.0-test-base-4 or >= ghostpdl-9.56.0-test-base-3, <= ghostpdl-9.56.0-test-base-3 or >= ghostpdl-9.56.0-test-base-2, <= ghostpdl-9.56.0-test-base-2 or >= ghostpdl-9.56.0-test-base-0, <= ghostpdl-9.56.0-test-base-0 or >= ghostpdl-9.55-test-base-0, <= ghostpdl-9.55-test-base-0 or >= ghostpdl-9.54.0-test-base-0, <= ghostpdl-9.54.0-test-base-0 or >= ghostpdl-9.52-test-base-4, <= ghostpdl-9.52-test-base-4 or >= ghostpdl-9.52-test-base-3, <= ghostpdl-9.52-test-base-3 or >= ghostpdl-9.52-test-base-1, <= ghostpdl-9.52-test-base-1 or >= chrisl-test, <= chrisl-test or >= jbig2dec-0.14, <= jbig2dec-0.14 or >= ghostpdl-9.02, <= ghostpdl-9.02 or >= ghostpdl, <= ghostpdl or >= ghostscript-9.02, <= ghostscript-9.02 or >= ghostscript-9.01, <= ghostscript-9.01 or >= ghostpdl-9.01, <= ghostpdl-9.01 or >= ghostpdl-9.00, <= ghostpdl-9.00 or >= ghostpdl-8.71, <= ghostpdl-8.71 or >= ghostscript-8.71, <= ghostscript-8.71 or >= ghostpdl-8.70, <= ghostpdl-8.70 or >= ghostscript-8.70, <= ghostscript-8.70 or >= ghostpdl-ebuild, <= ghostpdl-ebuild or >= ghostpdl-1.54, <= ghostpdl-1.54 or >= ghostscript-8.64, <= ghostscript-8.64 or >= ghostpdl-1.53, <= ghostpdl-1.53 or >= ghostscript-8.63, <= ghostscript-8.63 or >= ghostscript-8.62, <= ghostscript-8.62 or >= ghostscript-8.61, <= ghostscript-8.61 or >= ghostscript-8.60, <= ghostscript-8.60 or >= ghostscript-8.57, <= ghostscript-8.57 or >= ghostscript-8.56, <= ghostscript-8.56 or >= ghostscript-8.53, <= ghostscript-8.53 or >= ghostscript-8.52, <= ghostscript-8.52 or >= ghostscript-8.51, <= ghostscript-8.51 or >= ghostscript-8.50, <= ghostscript-8.50 or >= ghostscript-8.33, <= ghostscript-8.33 or >= ghostscript-8.32, <= ghostscript-8.32 or >= ghostscript-8.31, <= ghostscript-8.31 or >= ghostscript-8.30, <= ghostscript-8.30 or >= ghostscript-8.12, <= ghostscript-8.12 or >= ghostscript-8.11, <= ghostscript-8.11 or >= ghostscript-8.10, <= ghostscript-8.10 or >= ghostscript-8.15, <= ghostscript-8.15 or >= ghostscript-8.14, <= ghostscript-8.14 or >= ghostscript-8.13, <= ghostscript-8.13 or >= ghostscript-8.00, <= ghostscript-8.00 or >= ghostscript-8.01, <= ghostscript-8.01 or >= ghostscript-7.33, <= ghostscript-7.33 or >= ghostscript-7.32, <= ghostscript-7.32 or >= ghostscript-7.31, <= ghostscript-7.31 or >= ghostscript-7.30, <= ghostscript-7.30 or >= ghostscript-7.22, <= ghostscript-7.22 or >= ghostscript-7.21, <= ghostscript-7.21 or >= ghostscript-7.20, <= ghostscript-7.20 or >= ghostscript-7.03, <= ghostscript-7.03 or >= ghostscript-7.04, <= ghostscript-7.04 or >= ghostscript-7.02, <= ghostscript-7.02 or >= ghostscript-7.00, <= ghostscript-7.00 or >= ghostscript-6.64, <= ghostscript-6.64 or >= ghostscript-6.63, <= ghostscript-6.63 or >= ghostscript-6.62, <= ghostscript-6.62 or >= ghostscript-6.61, <= ghostscript-6.61 or >= ghostscript-6.60, <= ghostscript-6.60 or >= ghostscript-6.30, <= ghostscript-6.30 or >= ghostscript-6.50, <= ghostscript-6.50 or >= ghostscript-6.32, <= ghostscript-6.32 or >= ghostscript-6.31, <= ghostscript-6.31 or >= ghostscript-6.23, <= ghostscript-6.23 or >= ghostscript-6.22, <= ghostscript-6.22 or >= ghostscript-6.21, <= ghostscript-6.21 or >= ghostscript-6.20, <= ghostscript-6.20 or >= ghostscript-6.01, <= ghostscript-6.01 or >= ghostscript-6.0, <= ghostscript-6.0 or >= gs10080rc1, <= gs10080rc1 or >= gs10071, <= gs10071 or >= gs10071rc1, <= gs10071rc1 or >= gs10070, <= gs10070 or >= gs10070rc1, <= gs10070rc1 or >= gs10060, <= gs10060 or >= gs10.07.0rc1, <= gs10.07.0rc1 or >= gs10.06.0, <= gs10.06.0 or >= gs10060rc2, <= gs10060rc2 or >= gs10060rc1, <= gs10060rc1 or >= gs10051, <= gs10051 or >= gs100501, <= gs100501 or >= gs10050, <= gs10050 or >= gs10050rc1, <= gs10050rc1 or >= gs10040, <= gs10040 or >= gs10040rc1, <= gs10040rc1 or >= gs10031, <= gs10031 or >= 10.03.1, <= 10.03.1 or >= gs10030, <= gs10030 or >= gs10030rc1, <= gs10030rc1 or >= gs10021, <= gs10021 or >= gs10020, <= gs10020 or >= gs10020rc2, <= gs10020rc2 or >= gs10020rc1, <= gs10020rc1 or >= gs10012, <= gs10012 or >= gs10010rc1, <= gs10010rc1 or >= gs10011, <= gs10011 or >= gs1001, <= gs1001 or >= gs10010, <= gs10010 or >= gs10010rc2, <= gs10010rc2 or >= gs1000, <= gs1000 or >= gs9561, <= gs9561 or >= gs1000rc2, <= gs1000rc2 or >= gs10.0.0rc1, <= gs10.0.0rc1 or >= gs9560, <= gs9560 or >= gs9560rc2, <= gs9560rc2 or >= gs9560rc1, <= gs9560rc1 or >= gs9550, <= gs9550 or >= ghostpdl-9.55, <= ghostpdl-9.55 or >= gs9550rc1, <= gs9550rc1 or >= gs9540, <= gs9540 or >= gpdf_beta1, <= gpdf_beta1 or >= gpdf_alpha2, <= gpdf_alpha2 or >= gpdf_alpha1, <= gpdf_alpha1 or >= gs9533, <= gs9533 or >= 9.54.0rc1, <= 9.54.0rc1 or >= gs9532, <= gs9532 or >= gs9531, <= gs9531 or >= gs9530, <= gs9530 or >= gs952, <= gs952 or >= ghostpdl-9.53.0rc2, <= ghostpdl-9.53.0rc2 or >= ghostpdl-9.53.0rc1, <= ghostpdl-9.53.0rc1 or >= gs951, <= gs951 or >= ghostpdl-9.51, <= ghostpdl-9.51 or >= gs951rc3, <= gs951rc3 or >= ghostpdl-9.51rc2, <= ghostpdl-9.51rc2 or >= gs950, <= gs950 or >= gs928rc4, <= gs928rc4 or >= gs928rc3, <= gs928rc3 or >= gs928rc2, <= gs928rc2 or >= gs928rc1, <= gs928rc1 or >= gs927, <= gs927 or >= gs9.27, <= gs9.27 or >= 9.27, <= 9.27 or >= gs926, <= gs926 or >= gs9.26rc1, <= gs9.26rc1 or >= 9.27rc1, <= 9.27rc1 or >= gs925rc1, <= gs925rc1 or >= gs925, <= gs925 or >= gs924rc2, <= gs924rc2 or >= gs924, <= gs924 or >= gs923rc1, <= gs923rc1 or >= gs923, <= gs923 or >= gs922, <= gs922 or >= gs922rc2, <= gs922rc2 or >= gs922rc1, <= gs922rc1 or >= gs921, <= gs921 or >= gs920, <= gs920 or >= 9.21rc1, <= 9.21rc1 or >= gs920rc1, <= gs920rc1 or >= gs919, <= gs919 or >= gs918, <= gs918
- Patched version
- 10.08.0
CVE-2026-39919
An early warning has been issued for a critical heap-based buffer overflow vulnerability in Ghostscript versions prior to 10.08.0. This vulnerability, tracked as CVE-2026-39919, could allow attackers to cause memory corruption and achieve code execution.
What happened
Ghostscript versions prior to 10.08.0 reportedly contain a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter. This vulnerability, identified as CVE-2026-39919, has a CVSS score of 9.8, indicating a critical severity level. The flaw could enable attackers to cause memory corruption, potentially leading to arbitrary code execution. The vulnerability is under investigation and has not yet been exploited in the wild.
The affected versions include a wide range of Ghostscript releases, from older versions like 6.0 up to 10.07.1. The vulnerability impacts various components and test versions within this range. Users of these versions are advised to assess their exposure and take immediate action to mitigate the risk.
What to do about it
- Upgrade to Ghostscript version 10.08.0 or later to mitigate the risk.
- Review your software dependencies to identify any instances of affected Ghostscript versions.
- Apply the upgrade in a controlled environment before rolling it out to production to ensure stability.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
ghostscript is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using any version of Ghostscript prior to 10.08.0, including test versions and specific component releases listed in the affected components section.
What should I do right now?
Immediately upgrade to Ghostscript version 10.08.0 or later. Review your dependencies and apply the upgrade in a controlled environment before production deployment.
Is there an official fix available?
Yes, the official fix is to upgrade to Ghostscript version 10.08.0 or later.
Should I wait for further updates before upgrading?
It is recommended to upgrade to the patched version as soon as possible to mitigate the risk. Continue to monitor the primary sources for any further updates or additional patches.