Skip to main content
Apexward Pulse
Type Vulnerability

Memory corruption

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corrupt…

1 sourceCVE-2026-39919

At a glance

Medium
7-day window, from the last update
Possible~0.8% estimated chance of attack in 30 days
Evidence-weighted, not popularity
Signal

~0.8% estimated chance of attack in 30 days. Exploitation not confirmed.

Why Medium

Medium rather than High: UK relevance is 40 of 100, little UK-specific signal so far.

Briefing

There is no written leader briefing for this story yet. These questions come from the facts we hold.

Questions to ask IT

  • Are we affected by CVE-2026-39919, and which of our systems would be?
  • If it is not yet patched, what mitigation is in place, and will the fix be done by 10 Nov?

Next steps

  1. Confirm whether this affects systems or suppliers in your estate

Summary

  • A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files.
  • CVE-2026-39919 has an estimated ~0.8% chance of attack in 30 days (54.9th percentile) as of 2026-10-13 — probability signal, not confirmed exploitation

Read the original reportBleepingComputer(opens in a new tab)

3 reports

Part of Multiple software vulnerabilities disclosed

Pulse

Last checked 5d ago · Recheck overdue since 4 Nov 2026, 09:35 UK time

Update
3 Nov 2026, 09:35 UK time · 5d ago

held at 0.8%; ranking metadata was updated.

EscalationDe-escalationCritical / liveWhat these mean
Drag to pan · Ctrl / ⌘ + scroll or pinch to zoom6 events

Sources

How we know

Statements extracted from sources. Higher confidence means stronger corroboration.

  • ClaimedHeadline60% confidence

    Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corrupt…

  • ProbableSummary fact75% confidence

    A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files.

  • ConfirmedCVE identifier95% confidence

    Event involves CVE-2026-39919

  • ConfirmedEstimated attack likelihood95% confidence

    CVE-2026-39919 has an estimated ~0.8% chance of attack in 30 days (54.9th percentile) as of 2026-10-13 — probability signal, not confirmed exploitation