Red Hat Updates Ghostscript on RHEL 9 for CVE-2026-39919
Tech GuruQuick Answer
RHSA-2026:74457 fixes CVE-2026-39919 in the advisory's RHEL 9.8 package mapping. A crafted PDF containing a malformed JPEG 2000 image can corrupt heap memory in Ghostscript and potentially execute code. The CSAF fixed entries identify libgs 9.54.0-19.el9_8.1; update affected installed binaries through the matching supported channel.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Ghostscript on RHEL 9.8 EUS, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Ghostscript on RHEL 9.8 EUS |
|---|---|
| Advisory | RHSA-2026:74457 |
| CVE | CVE-2026-39919 |
| Authoritative release date | 2026-10-02 07:25:46 UTC |
| Authority revision date | 2026-10-02 09:34:23 UTC |
| Affected versions | Match RHSA-2026:74457 product relationships and installed packages. The top-level names say RHEL 9 AppStream/CodeReady Builder; the fixed libgs identifiers specify AppStream-9.8.0.Z.MAIN.EUS. This is not an E4S identifier. E4S means Update Services for SAP Solutions and must not be substituted for EUS. |
| Fixed version | ghostscript/libgs 9.54.0-19.el9_8.1 |
| CVSS base score | 7.8 (official CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The fault concerns mismatched image-component subsampling in the JPEG 2000 output adapter. Red Hat rates product impact Moderate because exploitation requires processing a crafted document, while the vulnerability has CVSS v3.1 7.8 High. Those labels measure different things and should not be silently treated as identical.
What To Validate Now
- Inventory. Locate Ghostscript on RHEL 9.8 EUS deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match entitlement, product stream, architecture, source package or image repository, and each advisory's product status. Do not apply one branch's build or digest to another branch.
- Remediate. Update affected installed Ghostscript-suite packages, including libgs, to the matching 9.54.0-19.el9_8.1 build or supported superseding fix. Verify entitlement and repository mapping rather than copying a package from another stream. These are RPM fixes, not a kernel livepatch or an advisory-listed container digest.
- Validate. Confirm the installed libgs build and restart long-running rendering consumers as required. Render or print a benign representative PDF through the actual application and inspect output/errors. Inventory applications that bundle another Ghostscript copy separately; do not use a malicious document as an acceptance test.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Confirm entitlement and branch support, test package or image compatibility, preserve prior packages or image digests and rollback evidence, and do not infer exploitation from severity.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
