Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Ghostscript may crash processing some JPEG 2000 files
published 14 days ago
Summary
The Ghostscript packages for CentOS (including the core, documentation, GTK, dvipdf, and font tools) can encounter a memory error when handling JPEG 2000 images with mismatched subsampling. This could cause the program to stop working or be vulnerable to further attacks. Install the latest Ghostscript updates from your vendor to fix the issue.
What to do
- Update centos ghostscript to version 9.27-1.el8_5.tuxcare.els2.
- Update centos ghostscript-doc to version 9.27-1.el8_5.tuxcare.els2.
- Update centos ghostscript-gtk to version 9.27-1.el8_5.tuxcare.els2.
- Update centos ghostscript-tools-dvipdf to version 9.27-1.el8_5.tuxcare.els2.
- Update centos ghostscript-tools-fonts to version 9.27-1.el8_5.tuxcare.els2.
- Update centos ghostscript-tools-printing to version 9.27-1.el8_5.tuxcare.els2.
- Update centos ghostscript-x11 to version 9.27-1.el8_5.tuxcare.els2.
- Update centos libgs to version 9.27-1.el8_5.tuxcare.els2.
- Update centos libgs-devel to version 9.27-1.el8_5.tuxcare.els2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:8.5 | centos | ghostscript |
< 9.27-1.el8_5.tuxcare.els2 Fix: upgrade to 9.27-1.el8_5.tuxcare.els2
|
| TuxCare:CentOS:8.5 | centos | ghostscript-doc |
< 9.27-1.el8_5.tuxcare.els2 Fix: upgrade to 9.27-1.el8_5.tuxcare.els2
|
| TuxCare:CentOS:8.5 | centos | ghostscript-gtk |
< 9.27-1.el8_5.tuxcare.els2 Fix: upgrade to 9.27-1.el8_5.tuxcare.els2
|
| TuxCare:CentOS:8.5 | centos | ghostscript-tools-dvipdf |
< 9.27-1.el8_5.tuxcare.els2 Fix: upgrade to 9.27-1.el8_5.tuxcare.els2
|
| TuxCare:CentOS:8.5 | centos | ghostscript-tools-fonts |
< 9.27-1.el8_5.tuxcare.els2 Fix: upgrade to 9.27-1.el8_5.tuxcare.els2
|
| TuxCare:CentOS:8.5 | centos | ghostscript-tools-printing |
< 9.27-1.el8_5.tuxcare.els2 Fix: upgrade to 9.27-1.el8_5.tuxcare.els2
|
| TuxCare:CentOS:8.5 | centos | ghostscript-x11 |
< 9.27-1.el8_5.tuxcare.els2 Fix: upgrade to 9.27-1.el8_5.tuxcare.els2
|
| TuxCare:CentOS:8.5 | centos | libgs |
< 9.27-1.el8_5.tuxcare.els2 Fix: upgrade to 9.27-1.el8_5.tuxcare.els2
|
| TuxCare:CentOS:8.5 | centos | libgs-devel |
< 9.27-1.el8_5.tuxcare.els2 Fix: upgrade to 9.27-1.el8_5.tuxcare.els2
|
Original advisory text
ghostscript: Fix of CVE-2026-39919
- CVE-2026-39919: fix heap buffer overflow in the JPEG 2000 decoder when
components use different subsampling factors
components use different subsampling factors
References
- https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1792576797.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39919 Vendor Advisory
Timeline
Published21 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1792576797 · OSV
Track software like this
Free during beta