CVE-2026-39919 is a heap-based buffer overflow vulnerability in Ghostscript prior to version 10.08.0, specifically in the JPEG 2000 output adapter (base/sjpx_openjpeg.c). The vulnerability arises when a crafted PDF contains a JPEG 2000 image with components declaring different subsampling values. The non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but incorrectly writes a full byte per output column regardless of bit depth. This causes an overflow of the allocated buffer, corrupting internal chunk-allocator metadata and potentially allowing an attacker to achieve arbitrary code execution.

Successful exploitation can lead to memory corruption and arbitrary code execution without requiring user interaction or privileges. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

A fix is available in Ghostscript version 10.08.0. Users should upgrade to version 10.08.0 or later to remediate this vulnerability. No vendor advisory content was provided, but the affected versions and patch version are clearly stated.