Description

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-15T15:17:14.723Z",
  "pubdate": "2026-09-15T15:17:14.723Z",
  "executiveSummary": "Ghostscript versions prior to 10.08.0 are susceptible to a critical heap-based buffer overflow vulnerability located within the JPEG 2000 output adapter. The flaw resides in base/sjpx_openjpeg.c and arises from improper handling of image component subsampling factors. An attacker can exploit this by crafting a malicious PDF document containing a specially formatted JPEG 2000 image. Successful exploitation leads to memory corruption, specifically targeting the internal chunk-allocator metadata. This allows for arbitrary code execution within the context of the Ghostscript process. The vulnerability presents a severe risk to any system that automatically processes untrusted PDF or image files using affected Ghostscript versions. Exploitation does not require authentication, but it does necessitate that a user or automated service opens or processes the malicious file. Given that Ghostscript is frequently utilized by document management systems, web servers, and PDF conversion utilities, the potential for remote code execution via file-based attack vectors is high.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow originating in the JPEG 2000 output adapter implemented in base/sjpx_openjpeg.c. The root cause is a logic error in the calculation and allocation of row buffers when processing JPEG 2000 images with mismatched component subsampling factors. Specifically, the implementation triggers a non-samescale sub-byte-depth output path where the allocated buffer size is insufficient for the actual data being written.\nDuring the processing of a JPEG 2000 image, if components define distinct subsampling values, the application attempts to perform a packed output conversion. The buffer allocation logic calculates the required heap space based on the assumption of packed output. However, the subsequent write operation ignores this packed constraint and writes a full byte per output column, regardless of the specified bit depth of the image data. This mismatch between the allocated buffer size and the actual bytes written facilitates a heap-based buffer overflow.\nThe attack flow begins with the delivery of a crafted PDF containing an embedded JPEG 2000 image. When Ghostscript invokes the rendering engine to process this image, the malformed subsampling factors trigger the flawed code path in the JPEG 2000 decoder. As the application writes the decompressed image data to the heap, the overflow overwrites adjacent memory regions. Because the Ghostscript interpreter utilizes a custom chunk-based memory allocator, the overflow specifically corrupts heap metadata structures. By carefully crafting the malicious JPEG 2000 parameters, an attacker can manipulate these metadata structures to achieve an arbitrary write primitive or hijack execution flow during subsequent heap operations, ultimately leading to code execution.\nAffected versions include all Ghostscript releases prior to 10.08.0. The vulnerability is triggered during the standard rendering or conversion process, meaning no specific authentication or elevated privileges are required beyond the ability to supply a file to the Ghostscript interpreter. This flaw is highly impactful in environments that use Ghostscript to parse user-provided PDF content, such as web-based document previewers, email scanners, and print spoolers. The lack of memory safety in the handling of image metadata enables attackers to bypass typical security controls if the input is processed with the privileges of the executing application or service."
}