Threat reportVulnerabilityTL-2026-3398
Critical Ghostscript Heap Buffer Overflow in JPEG 2000 Output Adapter Enables RCE via Malicious PDFs (CVE-2026-39919)
Critical Ghostscript Heap Buffer Overflow in JPEG 2000 (TL-2026-3398) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-13 and last reviewed 2026-10-14. It has no confirmed attribution, affects Artifex Software Ghostscript, references 2 CVEs (CVE-2026-39919, CVE-2026-65640), maps to 7 MITRE ATT&CK techniques (T1036.008, T1059, T1190), and is covered by 9 detection rules and 18 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-3398
- Threat ID
- TL-2026-3398
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, media-publishing, government administration, finance, business-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
- Updates
- 2026-10-14 · 2 updates · revalidated 2× · latest source
Malware and tooling in Critical Ghostscript Heap Buffer Overflow in JPEG 2000
Malware and tooling: ImageMagick, Imagick
How Critical Ghostscript Heap Buffer Overflow in JPEG 2000 works
CVE-2026-39919 is a heap-based buffer overflow in Ghostscript's JPEG 2000 output adapter (base/sjpx_openjpeg.c), triggered by PDFs embedding JPEG 2000 images with mismatched component subsampling, and can lead to remote code execution. All Ghostscript versions before 10.08.0 are affected; a functional PoC was demonstrated against a WordPress -> Imagick -> ImageMagick -> Ghostscript chain, but no in-the-wild exploitation or CISA KEV listing is stated in the sources.
CVE-2026-39919 (CWE-122) is a heap-based buffer overflow in the JPEG 2000 output adapter of Ghostscript (Artifex Software), implemented in base/sjpx_openjpeg.c. When the components of a JPEG 2000 image declare different subsampling factors, the non-samescale, sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte for each output column regardless of bit depth. The overflow corrupts the internal chunk-allocator (memory-management) metadata, which can be leveraged for code execution. The trigger is a crafted PDF containing a JPEG 2000 image with sub-byte sample precision and differing component resolutions.
The flaw was reported by Alex Thomas of Wordfence (Wordfence Threat Intelligence / Wordfence Argus) during a WordPress 7.1 security assessment. The vulnerability was published on 2026-09-15 (NVD, VulnCheck, Red Hat) with a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) and CVSS v4.0 score of 9.3. Ghostscript 10.08.0 (released 2026-09-08) contains the fix. The upstream patch (commit 0a8bf88e, authored by Ken Sharp) touches only base/sjpx_openjpeg.c: it rejects unsupported bit depths (only 1, 2, 4, 8 and 16 are accepted), corrects the inner sampling loop to count samples rather than bytes, and adds a bounds check before reading component data so reads cannot run past the image width. Wordfence's public write-up and the GBHackers report followed on 2026-10-13.
The demonstrated attack chain runs through WordPress document handling: a malicious PDF with an embedded JPEG 2000 image is uploaded to the Media Library, WordPress calls Imagick to generate a preview, ImageMagick invokes Ghostscript to render the first page, the overflow triggers during image processing, and the resulting memory corruption yields code execution. Any service that accepts PDFs from untrusted parties and renders them with Ghostscript is relevant: upload forms, document portals, invoice-processing systems, print services, mail gateways, preview generators and file-conversion APIs. Wordfence reported a functional RCE on a purpose-built WordPress deployment, but also noted that its proof-of-concept exploits were build-specific: files developed for one Ghostscript environment did not work unchanged across ten Linux package environments. This reduces universal reliability, although attackers can adapt payloads for common hosting environments.
The sources do not report in-the-wild exploitation, attributed threat actors, or CISA KEV listing, and no network or file IOCs have been published. Separately, WordPress 7.0.4 (2026-08-13) fixed the distinct CVE-2026-65640 (CVSS 8.8), in which an Author-level user uploads a PostScript payload disguised as a PNG that ImageMagick passes to Ghostscript; it is a related WordPress/Imagick/Ghostscript attack surface, not the same vulnerability. Distributions have shipped fixes (Debian DSA-6516-1, fixed trixie package 10.05.1~dfsg-1+deb13u3, forky/sid 10.08.0~dfsg-2; Red Hat RHSA-2026:76877 / 74457 / 74464 for EL8/9/10).
MITRE ATT&CK techniques used in TL-2026-3398
Defense Evasion
T1036.008 Masquerade File Type
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
Affected products and versions in Critical Ghostscript Heap Buffer Overflow in JPEG 2000
- Artifex Software — Ghostscript
Vulnerable versions: all versions before 10.08.0
Fixed in: 10.08.0 - Debian — ghostscript package
Vulnerable versions: 10.0.0~dfsg-11+deb12u8 (bookworm); 10.05.1~dfsg-1+deb13u1 (trixie)
Fixed in: 10.05.1~dfsg-1+deb13u3 (trixie security); 10.08.0~dfsg-2 (forky/sid) - Red Hat — ghostscript on Enterprise Linux 8, 9, 10
Vulnerable versions: pre-erratum builds
Fixed in: RHSA-2026:76877; RHSA-2026:74457; RHSA-2026:74464
Remediation for Critical Ghostscript Heap Buffer Overflow in JPEG 2000
Patches
- Ghostscript 10.08.0 (upstream fix commit 0a8bf88e39db07b0751a58d6ec1cf992073e4dc1)
- Debian DSA-6516-1 (trixie 10.05.1~dfsg-1+deb13u3; forky/sid 10.08.0~dfsg-2)
- Red Hat RHSA-2026:76877 (EL8), RHSA-2026:74457 (EL9), RHSA-2026:74464 (EL10)
Immediate actions
- Upgrade Ghostscript to 10.08.0 or later (or the distribution-patched package) on every host that renders untrusted PDFs
- Suspend or quarantine untrusted PDF uploads until patched
- Disable PDF rendering in the ImageMagick security policy (policy.xml) where PDF previews are not required
- Inventory systems that call Ghostscript indirectly (WordPress Imagick, ImageMagick, mail gateways, print and conversion services)
Workarounds
- Avoid use of the JPEG 2000 output adapter until the package is updated
- Block ImageMagick PDF/PS/EPS coders via policy.xml
- Disable PDF previews in the Imagick/WordPress image pipeline
Longer-term hardening
- Run document conversion in isolated, minimally-privileged services or sandboxes
- Rebuild containers from updated base images and follow vendor restart guidance
- Restrict who can upload files that reach ImageMagick/Ghostscript and apply the WordPress 7.0.4+ fix for the related CVE-2026-65640
CVEs associated with Critical Ghostscript Heap Buffer Overflow in JPEG 2000
Weaknesses (CWE) in Critical Ghostscript Heap Buffer Overflow in JPEG 2000
Timeline of Critical Ghostscript Heap Buffer Overflow in JPEG 2000
- WordPress 7.0.4 fixes the related CVE-2026-65640 (CVSS 8.8), where a PostScript payload disguised as a PNG reaches Ghostscript through Imagick/ImageMagick
- Wordfence researchers report the JPEG 2000 heap overflow to Artifex Software (Ghostscript bug 709666).
- Artifex confirms the vulnerability.
- Ghostscript 10.08.0 released, containing the fix to base/sjpx_openjpeg.c (commit 0a8bf88e by Ken Sharp)
- Debian Security Tracker records CVE-2026-39919 (DSA-6516-1) listing bookworm 10.0.0~dfsg-11+deb12u8 and trixie 10.05.1~dfsg-1+deb13u1 as vulnerable, with fixes in trixie 10.05.1~dfsg-1+deb13u3 and forky/sid 10.08.0~dfsg-2; the tracker cites fix commit 8ddaa67d and Ghostscript bug 709666
- CVE-2026-39919 published (CVSS v3.1 9.8 / v4.0 9.3); VulnCheck advisory and Red Hat Bugzilla entry created; upstream bug 709666 referenced
- SecurityOnline publishes analysis noting -dSAFER does not mitigate the flaw and that no in-the-wild exploitation is confirmed (EPSS 0.8%).
- Red Hat Bugzilla 2537359 opened to track the flaw for Fedora (rawhide), assigned to Zdenek Dohnal with Medium priority; no fixed version listed at that time
- Red Hat Bugzilla record last modified; RHSA-2026:76877, RHSA-2026:74457 and RHSA-2026:74464 listed for EL8, EL9 and EL10
- Wordfence publishes its research and GBHackers reports the flaw: functional RCE shown on a purpose-built WordPress site via Imagick -> ImageMagick -> Ghostscript; PoCs were build-specific across ten Linux package environments
Update history for TL-2026-3398
- 2026-10-14 — Ghostscript heap buffer overflow RCE via crafted PDF (JPEG 2000) uploads - CVE-2026-39919: What changed No field escalation. Severity (CRITICAL), exploitability (POC_PUBLIC) and CVSS (9.8) are unchanged. The report lists status PATCHED, but the existing ACTIVE status is kept because the change is not an evidenced escalation. New
- 2026-10-13 — CVE-2026-39919: Ghostscript JPEG 2000 Heap Buffer Overflow Enables Code Execution via Malicious PDF: What changed No severity, exploitability or status change. Additive context only. New indicators (5) Added libgs and ghostpdl package names, CUPS as an additional Ghostscript caller, php-fpm as the execution context, and the gs -dSAFER cave
Sources cited for Critical Ghostscript Heap Buffer Overflow in JPEG 2000
- NVD - CVE-2026-39919
- VulnCheck Advisory: Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter
- Ghostscript Bugzilla 709666
- ghostpdl fix commit 0a8bf88e (base/sjpx_openjpeg.c)
- Ghostscript/GhostPDL 10.08.0 release
- Debian Security Tracker - CVE-2026-39919
- Red Hat Bugzilla 2533857 - CVE-2026-39919 ghostscript: Heap buffer overflow via JPEG 2000 output adapter
- Red Hat Bugzilla 2537359 - CVE-2026-39919 ghostscript [fedora-all]
- Critical Ghostscript Vulnerability Lets Malicious PDFs Trigger Remote Code Execution (GBHackers)
- WordPress 7.0.4 Patches Remote Code Execution Vulnerability (related CVE-2026-65640, SecurityWeek)
Detection coverage for TL-2026-3398
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3398 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.