Ghostscript's JPEG 2000 code gets a 9.8-rated fix - but check before you panic

A newly catalogued vulnerability in Ghostscript, the open-source engine that quietly renders an enormous chunk of the world’s PDFs and PostScript files, has landed with a critical CVSS score of 9.8. That’s the kind of number that tends to trigger panicked Slack messages in IT departments. Here’s what’s actually solid, and what still needs a pinch of salt.

What the bug actually does

According to the NVD entry for CVE-2026-39919, published on 15 September 2026, every version of Ghostscript before 10.08.0 contains a heap-based buffer overflow in its JPEG 2000 output adapter, specifically in the file base/sjpx_openjpeg.c. In plain terms: when Ghostscript processes a specially crafted JPEG 2000 image, a flaw in how it handles that data can corrupt memory on the heap. That’s the class of bug that, in the worst case, can be steered towards crashing a program or running attacker-controlled code, which is why it’s scored so severely.

What we can’t independently verify is the finer detail of how easy that is to actually pull off in practice. The Ghostscript project’s own bug tracker, where this issue was originally logged, is currently sitting behind an anti-bot challenge page rather than showing the actual report - so any extra technical nuance from the original filing simply isn’t visible to us or, for now, to the public. That’s a gap worth noting rather than glossing over: a 9.8 score reflects a theoretical worst case under CVSS’s scoring rules, not necessarily a demonstrated, weaponised exploit sitting in the wild.

The good news is that Artifex Software, which maintains Ghostscript, has already shipped a fix. The 10.08.0 release on GitHub went out on 8 September 2026, ahead of the CVE’s public disclosure, which is the pattern you’d want to see: patch first, publicise second.

So who is actually at risk

Ghostscript itself isn’t something most people install directly - but it’s baked into a surprising amount of infrastructure most people never see. It powers PDF-to-image conversion, print pipelines, document processing tools, and is bundled inside various Linux distributions and server-side software that handles user-uploaded files. If you’re running a personal PC that occasionally opens a PDF in a modern reader, you’re probably using a completely different renderer and this doesn’t touch you directly.

The people who should actually care are system administrators and developers running servers or services that use Ghostscript to process files - particularly anything that lets untrusted users upload PDFs, PostScript, or JPEG 2000-embedded documents for automatic conversion or thumbnailing. There’s no public evidence cited here of active exploitation; this is a disclosed-and-patched flaw, not a confirmed attack campaign.

What to do about it

If you or your organisation maintain servers, containers, or pipelines that bundle Ghostscript - directly or as a dependency of something like ImageMagick or a document-conversion service - the sensible move is to check your version and upgrade to 10.08.0 or later. Most Linux distributions will push this through their normal package updates in due course, so keeping systems patched as usual should cover it.

The takeaway

This is a genuinely serious bug for the narrow band of systems that feed untrusted files into Ghostscript’s JPEG 2000 handling, and the fix already exists. It is not a reason for ordinary desktop users to lose sleep, nor is there yet any confirmed evidence of it being exploited. Patch it if it applies to you, and treat the 9.8 score as a measure of potential severity - not proof of an active threat.