# Critical Ghostscript Heap Buffer Overflow in JPEG 2000 Output Adapter Enables RCE via Malicious PDFs (CVE-2026-39919)

> CVE-2026-39919 is a heap-based buffer overflow in Ghostscript's JPEG 2000 output adapter (base/sjpx_openjpeg.c), triggered by PDFs embedding JPEG 2000 images with mismatched component subsampling, and can lead to remote code execution. All Ghostscript versions before 10.08.0 are affected; a functional PoC was demonstrated against a WordPress -> Imagick -> ImageMagick -> Ghostscript chain, but no in-the-wild exploitation or CISA KEV listing is stated in the sources.

- **Published:** 2026-10-13T11:03:59Z
- **Last reviewed:** 2026-10-14T03:50:31.004Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3398
- **ID:** TL-2026-3398
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-39919, CVE-2026-65640

## Description

CVE-2026-39919 (CWE-122) is a heap-based buffer overflow in the JPEG 2000 output adapter of Ghostscript (Artifex Software), implemented in base/sjpx_openjpeg.c. When the components of a JPEG 2000 image declare different subsampling factors, the non-samescale, sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte for each output column regardless of bit depth. The overflow corrupts the internal chunk-allocator (memory-management) metadata, which can be leveraged for code execution. The trigger is a crafted PDF containing a JPEG 2000 image with sub-byte sample precision and differing component resolutions.

The flaw was reported by Alex Thomas of Wordfence (Wordfence Threat Intelligence / Wordfence Argus) during a WordPress 7.1 security assessment. The vulnerability was published on 2026-09-15 (NVD, VulnCheck, Red Hat) with a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) and CVSS v4.0 score of 9.3. Ghostscript 10.08.0 (released 2026-09-08) contains the fix. The upstream patch (commit 0a8bf88e, authored by Ken Sharp) touches only base/sjpx_openjpeg.c: it rejects unsupported bit depths (only 1, 2, 4, 8 and 16 are accepted), corrects the inner sampling loop to count samples rather than bytes, and adds a bounds check before reading component data so reads cannot run past the image width. Wordfence's public write-up and the GBHackers report followed on 2026-10-13.

The demonstrated attack chain runs through WordPress document handling: a malicious PDF with an embedded JPEG 2000 image is uploaded to the Media Library, WordPress calls Imagick to generate a preview, ImageMagick invokes Ghostscript to render the first page, the overflow triggers during image processing, and the resulting memory corruption yields code execution. Any service that accepts PDFs from untrusted parties and renders them with Ghostscript is relevant: upload forms, document portals, invoice-processing systems, print services, mail gateways, preview generators and file-conversion APIs. Wordfence reported a functional RCE on a purpose-built WordPress deployment, but also noted that its proof-of-concept exploits were build-specific: files developed for one Ghostscript environment did not work unchanged across ten Linux package environments. This reduces universal reliability, although attackers can adapt payloads for common hosting environments.

The sources do not report in-the-wild exploitation, attributed threat actors, or CISA KEV listing, and no network or file IOCs have been published. Separately, WordPress 7.0.4 (2026-08-13) fixed the distinct CVE-2026-65640 (CVSS 8.8), in which an Author-level user uploads a PostScript payload disguised as a PNG that ImageMagick passes to Ghostscript; it is a related WordPress/Imagick/Ghostscript attack surface, not the same vulnerability. Distributions have shipped fixes (Debian DSA-6516-1, fixed trixie package 10.05.1~dfsg-1+deb13u3, forky/sid 10.08.0~dfsg-2; Red Hat RHSA-2026:76877 / 74457 / 74464 for EL8/9/10).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1587.004 Exploits
- T1036.008 Masquerade File Type
- T1204.002 User Execution: Malicious File
- T1588.005 Obtain Capabilities

## Sources

- [NVD - CVE-2026-39919](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-39919)
- [VulnCheck Advisory: Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter](https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-2000-output-adapter)
- [Ghostscript Bugzilla 709666](https://bugs.ghostscript.com/show_bug.cgi?id=709666)
- [ghostpdl fix commit 0a8bf88e (base/sjpx_openjpeg.c)](https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1)
- [Ghostscript/GhostPDL 10.08.0 release](https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080)
- [Debian Security Tracker - CVE-2026-39919](https://security-tracker.debian.org/tracker/CVE-2026-39919)
- [Red Hat Bugzilla 2533857 - CVE-2026-39919 ghostscript: Heap buffer overflow via JPEG 2000 output adapter](https://bugzilla.redhat.com/show_bug.cgi?id=2533857)
- [Red Hat Bugzilla 2537359 - CVE-2026-39919 ghostscript fedora-all](https://bugzilla.redhat.com/show_bug.cgi?id=2537359)
- [Critical Ghostscript Vulnerability Lets Malicious PDFs Trigger Remote Code Execution (GBHackers)](https://gbhackers.com/ghostscript-vulnerability/)
- [WordPress 7.0.4 Patches Remote Code Execution Vulnerability (related CVE-2026-65640, SecurityWeek)](https://www.securityweek.com/wordpress-7-0-4-patches-remote-code-execution-vulnerability/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3398