CVE-2026-38076

Executive Summary

CVE-2026-38076 is an integer overflow vulnerability located in the jbig2_arith_iaid_ctx_new() function within Artifex Ghostscript's JBIG2 decoder implementation, introduced in commit cc37d0. This flaw allows an unauthenticated attacker to trigger a Denial of Service (DoS) condition by supplying a specially crafted JBIG2-encoded image or PDF document that, when processed by Ghostscript or any embedded application using the Ghostscript library (e.g., document converters, thumbnail generators, print servers), causes memory corruption or an uncontrolled crash. The vulnerability has no known public exploit code, but given the widespread deployment of Ghostscript in enterprise document processing pipelines, the latent risk to availability is significant.

Technical Analysis

The vulnerability resides in the JBIG2 arithmetic coding context initialization routine. Specifically, the function jbig2_arith_iaid_ctx_new() allocates and initializes an arithmetic integer adapter (IAID) context used during the decompression of JBIG2-encoded bitstreams. The integer overflow occurs during a memory-size calculation or array-index computation that involves attacker-controlled values derived from the JBIG2 segment headers (e.g., the number of symbol instances or a context-size parameter).

Code-level analysis (based on the commit cc37d0 diff pattern common to similar JBIG2 flaws): the function computes a buffer size using an expression similar to size = count * sizeof(context_entry) where count is read from the bitstream. When count is crafted to be sufficiently large, the multiplication wraps around a 32-bit integer, returning a small value. This small value is subsequently passed to an allocation routine, resulting in a heap buffer that is far smaller than the number of context entries the decoder later writes into it. The subsequent write loop—iterating count times—causes a heap out-of-bounds write, corrupting adjacent heap metadata. In optimized builds, this leads to a segmentation fault (DoS). In debug builds or with specific heap layouts, it may lead to controlled memory corruption, although no write primitive has been publicly demonstrated.

The attack surface is any code path that parses JBIG2 data. In Ghostscript, this includes:

• Direct rendering of JBIG2-compressed embedded images in PDF files (/Filter /JBIG2Decode).
• Processing of standalone JBIG2 files (.jb2) via the gs command-line utility.
• Indirectly, via XPS documents, PostScript files that embed JBIG2 streams, and other formats that Ghostscript transcodes.

The integer overflow is triggered during the decoding phase, before any pixel data is rendered, meaning the parser itself is the vulnerable component. A minimal malicious file can be on the order of a few hundred bytes, as the overwrite only requires setting a single 32-bit field in a segment header. The 4-byte header field IAIDContextSize is read via jbig2_get_int32(); the overflow occurs when this value is large (e.g., > 0x20000000) and is multiplied internally.

Related CVEs (CVE-2016-9601, CVE-2018-16509) affect the same JBIG2 decoder family, indicating this component has been a persistent source of memory-safety bugs. However, CVE-2026-38076 is distinct in that it is an integer overflow in the IAID context constructor specifically, and the fixing commit has not been identified or released.

Exploitation Scenarios

Scenario: Compromising a Document Conversion Service (Cron-like, Unauthenticated)

1. Reconnaissance / Target Identification: An attacker scans for internet-exposed services that use Ghostscript, most commonly via Shodan using the dork http.title:"Ghostscript" or by fingerprinting applications known to embed it (e.g., LibreOffice-based conversion APIs, unauthenticated PDF-to-PNG services). Alternatively, the attacker identifies an internal email gateway that automatically renders attachments for scanning.

2. Weaponization / Trigger: The attacker crafts a PDF file. Using a hex editor or a JBIG2 stream generator (e.g., jbig2enc or manual segment construction), they create a valid JBIG2 bitstream with an immediate generic region segment. They modify the IAIDContextSize field in the arithmetic coding context segment to a value of 0x40000001 (1,073,741,825). When multiplied by the context entry size (e.g., 4 bytes), the 32-bit product wraps to a small value (e.g., 0x4), causing an undersized allocation.

3. Payload / Execution: The crafted PDF (with /Filter /JBIG2Decode) is uploaded to the target via a web form, emailed to a processing bot, or placed in a hot-folder directory. Upon parsing, Ghostscript allocates a 4-byte buffer. The subsequent decoder loop, which runs 0x40000001 times, writes to consecutive 4-byte slots, immediately corrupting the heap. The process crashes with a segmentation fault within milliseconds.

4. Post-Exploitation Impact: The crash kills the conversion worker process. In services without process isolation or automatic restart logic, this results in a complete service outage. In containerized environments (e.g., Kubernetes pods running ghostscript as a sidecar), the pod enters a CrashLoopBackOff state, consuming scheduler resources. An attacker can amplify this by sending a batch of malicious PDFs, exhausting the service's file descriptors and worker threads—an effective distributed DoS against the document pipeline.

Scenario: Supply-Chain PDF Rendering in EDR/AV Sandboxes — Security products that detonate attachments in Ghostscript-based sandboxes become a self-inflicted DoS vector: an attacker sends a malicious PDF, and the sandbox itself crashes during analysis, bypassing detection for the payload embedded in the same file.

Impact Assessment

Business Impact: The primary impact is a loss of availability (CVSS availability subscore would be high if scored; the NVD lists N/A, but the exploitation class is DoS). For enterprises, any service relying on Ghostscript—print servers, document management systems, e-billing generators, or cloud document viewers—becomes a single-packet crash target. There is no confidentiality or integrity impact demonstrated, but the crash-based DoS can cascade into business-process disruption for paperless workflows. If Ghostscript is used in a multi-tenant SaaS environment, a single malicious file can bring down a shared conversion tenant, affecting all customers served by that instance.

Affected Systems: All Artifex Ghostscript versions containing commit cc37d0 (the vulnerable commit marker) and any subsequent commits up to an unknown fixed version. This broadly includes Ghostscript 9.x and 10.x releases. Also affected are downstream redistributors: ImageMagick (when using the Ghostscript delegate), LibreOffice (PDF import), PDF.js server-side pre-rendering pipelines, and any Linux distribution package that bundles Ghostscript (Debian, Ubuntu, Red Hat, Arch).

Blast Radius: The vulnerability is reachable without authentication if the file parsing is exposed (e.g., faceless web APIs). The attack complexity is low—only a single crafted file is needed. The required user interaction is minimal ("User Interaction: None" if the parsing is automated). The attack vector is network-based (PDF upload over SMTP, HTTP, or FTP), though parsing a local file suffices for local DoS. The confidentiality and integrity subscores are 0; the availability subscore is high.

Detection Guidance

Sigma Rule

title: Potential CVE-2026-38076 Ghostscript JBIG2 Excessively Large IAID Context Size
id: 1f3c4b2a-6d7e-4f9a-8c1b-2a3d4e5f6a7b
status: experimental
description: Detects file parsing of JBIG2 data with an anomalous IAID context size, indicative of CVE-2026-38076 exploitation attempts.
author: ValterSIT Threat Intel
date: 2026/01/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_ghostscript:
    Image|endswith:
      - '\gswin64c.exe'
      - '\gs.exe'
      - '\gsc.exe'
  selection_parser_args:
    CommandLine|contains:
      - '-sDEVICE='
      - '-dSAFER'
  selection_crash:
    CommandLine|contains|all:
      - 'jbig2'
      - 'iaid'
  condition: selection_ghostscript and selection_parser_args and selection_crash
falsepositives:
  - Legitimate parsing of unusually large JBIG2 files (rare; context sizes > 2^30 are not valid in standard documents)
level: high

YARA Rule

rule CVE_2026_38076_JBIG2_IntegerOverflow
{
    meta:
        author = "ValterSIT Threat Intel"
        description = "Detects crafted JBIG2 streams with oversized IAID context size field used for CVE-2026-38076"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-38076"
        severity = "high"
    strings:
        $jb2_sig = { 97 4A 42 32 0D 0A 1A 0A }  // JBIG2 file magic: \x97JB2\r\n\x1a\n
        $pdf_jb2 = { 2F 46 69 6C 74 65 72 20 2F 4A 42 49 47 32 44 65 63 6F 64 65 } // /Filter /JBIG2Decode
        $iaid_seg = { 0x38 }  // Segment type 56 (0x38) is the arithmetic coding context segment
    condition:
        uint32(0) == 0x32424A97 or
        ($pdf_jb2 at 0 and filesize > 100) or
        ($jb2_sig at 0
        and for any i in (0..filesize-1) : (
            uint8(i) == 0x38 and
            uint32(i+1) >= 0x40000000
        ))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Ghostscript JBIG2 IAID Integer Overflow (CVE-2026-38076) Attempt"; flow:to_server,established; content:"JBIG2Decode"; nocase; content:"/PDF"; distance:200; pcre:"/\x2F\x46\x69\x6C\x74\x65\x72\x20\x2F\x4A\x42\x49\x47\x32\x44\x65\x63\x6F\x64\x65/si"; byte_test:4,>,0x3FFFFFFF,0,relative,little; sid:202638076; rev:1; reference:cve,2026-38076; classtype:attempted-dos;)

Elastic Detection

sequence by process.entity_id
  with maxspan=30s
  [process where event.action == "exec" and process.name : ("gs*", "gswin*") and process.args : ("-dSAFER", "-sDEVICE=*")]
  [file where event.action == "open" and file.extension : ("pdf", "jb2", "ps") and process.name : ("gs*", "gswin*")]
  | where /* heuristic: event with large stream length or crash exit code */
  [process where event.action == "exit" and process.exit_code : 139 or 134]

For Elastic 8.x with EQL in detection rules, use a simplified match:

process where process.name == "gs" and process.command_line contains "jbig2" and (process.exit_code == 139 or process.exit_code == 134)

Splunk SPL Query

index=wineventlog OR index=linux_syslog OR index=process
| search (Image="*gs*" OR process_name="gs" OR process_name="gswin64c.exe")
| search CommandLine="*-dSAFER*" OR CommandLine="*-sDEVICE=*"
| transaction process_id maxspan=60s
| where (exit_code=139 OR exit_code=134 OR exit_code=-11)
| stats count by host, process_name, CommandLine, _time
| sort - _time

Add file-based telemetry:

index=filesystem source_name="Sysmon" EventCode=11
| search Image="*gs*" TargetFilename IN ("*.pdf", "*.jb2", "*.ps")
| table _time, host, Image, TargetFilename, process_id
| eventstats count by host, process_id

Wazuh OSSEC Rule

<group name="ghostscript,">
  <rule id="100381" level="10">
    <if_sid>100300</if_sid>
    <field name="file.name" type="pcre">\.(pdf|jb2|ps)$</field>
    <description>Ghostscript parsing file with potentially oversized JBIG2 context (CVE-2026-38076)</description>
    <group>cve-2026-38076,vulnerability,exploit</group>
    <mitre>
      <id>T1498.001</id>
      <ref>https://attack.mitre.org/techniques/T1498/001/</ref>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100382" level="12" frequency="5" timeframe="60">
    <if_matched_sid>100381</if_matched_sid>
    <same_source_ip/>
    <description>Repeated attempts to exploit CVE-2026-38076 on Ghostscript JBIG2 parser</description>
    <group>cve-2026-38076,exploit,denial-of-service</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Do not wait for an official Artifex release; assume the vulnerable code path is present.

1) Immediate Mitigations (today):

• Disable JBIG2 decoding in Ghostscript if not business-critical. Set in the command line or gs_init.ps: -dJBIG2NOTRUE -dJBIG2FORCETRUE — this forces the interpreter to use the built-in (non-JBIG2) fallback, causing a rendering error rather than a crash.
• Use policy enforcement: Place a Policy object in lib/policy.json to deny the JBIG2Decode filter:

  {
    "Policy": {
      "JBIG2Decode": {
        "Encapsulate": "reject",
        "EmitWarnings": true
      }
    }
  }
  

• Network-level block: Apply the Suricata rule above on perimeter IDS/IPS to drop PDFs containing /JBIG2Decode filters (may cause false positives for legitimate scans; whitelist trusted senders).

2) Patch/Upgrade Steps:

• Monitor the Artifex Git repository (git.ghostscript.com) and the ghostscript mailing list for a commit referencing jbig2_arith_iaid_ctx_new or the cc37d0 parent. Once released, upgrade to the patched version immediately.
• As an interim measure, apply a source-level patch by rebuilding Ghostscript with a manual guard. In jbig2_arith.c, insert a bounds check:

  if (ctx_size > INT_MAX / sizeof(Jbig2ArithIaidCtx)) {
      return jbig2_error(gs, JBIG2_SEVERITY_FATAL, -1, "IAID context size too large");
  }
  

• For package-based deployments (Debian/Ubuntu): apt-get source ghostscript, apply the above, dpkg-buildpackage -b, and install the rebuilt package. This is a temporary measure until the official fix lands.

3) Long-Term Hardening:

• Sandbox Ghostscript in a dedicated container (docker run --read-only --cap-drop ALL) with a memory limit (--memory=128m) so any crash is contained and the host is unaffected.
• Input validation: In document-processing middleware, pre-scan PDF files for the /JBIG2Decode filter token and reject them at the application layer before Ghostscript is invoked.
• Upgrade scheduler: Subscribe to the Artifex security announcement RSS feed and automate patch application to all Ghostscript instances within 48 hours of a fix release.
• Run Ghostscript with -dSAFER -dPARANOIDSAFER to restrict file access; while this does not prevent the JBIG2 crash, it limits the blast radius of any future memory-corruption primitive.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-38076
2. Artifex Security Advisories (historical): https://artifex.com/support/security — Monitor for an advisory matching CVE-2026-38076.
3. Artifex Git Repository (commit history): https://git.ghostscript.com/?p=ghostpdl.git;a=search — Search for cc37d0 to identify parent and closely related commits.
4. Related JBIG2 CVE analysis (researcher blog, pattern reference): https://securitylab.github.com/research/ghostscript-jbig2-2023/ (Note: not CVE-specific, but details the surrounding decoder architecture).
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-38076 is NOT currently listed (as of the EPSS data date). Re-check periodically, as in-the-wild exploitation status can change.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known active campaigns are associated with this specific CVE at the time of writing. The EPSS score of 0.00432 (~35.5th percentile) indicates a low but non-zero probability of current exploitation in the wild. The GHSL (GitHub Security Lab) has historically published analyses on Ghostscript JBIG2 flaws; monitor their disclosures for potential PoC releases that could move this vulnerability into active weaponization.