An integer overflow in the jbig2_arith_iaid_ctx_new

CVE-2026-38076 is an integer overflow (CWE-190) in jbig2_arith_iaid_ctx_new() within Artifex's jbig2dec library — a JBIG2 image-compression decoder bundled inside Ghostscript and MuPDF. A crafted JBIG2 stream (typically embedded in a PDF) triggers a signed integer overflow in the SBSYMCODELEN decoding loop, causing an out-of-bounds memory access and an application crash. All versions of jbig2dec prior to commit cc37d09 are affected. On Ubuntu, fixes ship as 0.20-1ubuntu0.26.04.1 (26.04 LTS), 0.20-1ubuntu0.24.04.1 (24.04 LTS), and 0.19-3ubuntu0.1 (22.04 LTS). The impact ceiling is Denial of Service only — the CVSS vector explicitly scores C:N/I:N/A:H.

The vendor severity of HIGH (7.5) is inflated for most enterprise environments. The CVSS vector claims AV:N/AC:L/PR:N/UI:N, implying a trivially reachable unauthenticated network service — but jbig2dec is a file-parsing library, not a listening daemon. An attacker must deliver a malicious PDF to a process that calls jbig2dec (Ghostscript CLI, MuPDF viewer, a document-conversion pipeline). In practice this means phishing a user into opening a PDF, or uploading a poisoned document to a server-side converter. The blast radius is a single process crash with no persistence, no code execution, and no data exfiltration. Vendor severity treats this as a network-facing availability nuke; reality says it's a file-based application crash.

Why this verdict

• DoS-only ceiling: The integer overflow leads to an OOB read and process crash. CVSS explicitly marks C:N/I:N/A:H. No write primitive, no RCE, no data leak. This alone caps real-world severity well below the HIGH threshold for most enterprises.
• File-delivery prerequisite misrepresented by CVSS AV:N/UI:N: jbig2dec is a library, not a listening service. Exploitation requires delivering a crafted PDF to a Ghostscript/MuPDF consumer — email, web upload, or file share. This is functionally UI:R or at minimum requires a document-processing pipeline, not raw network access.
• No weaponization: Zero public PoCs, no exploit kits, no threat-actor campaigns, EPSS 0.006, no KEV listing. The attack remains theoretical.
• Role multiplier: (a) *Low-value role* — desktop MuPDF user: crash a viewer, user reopens another PDF reader. Blast radius: single process. (b) *Typical role* — server-side Ghostscript in a document-conversion pipeline: crash one conversion job; systemd restarts the service in seconds. Blast radius: single request. (c) *High-value role* — print server or document-ingestion gateway: repeated poisoned PDFs could degrade availability, but the process restarts and there is no escalation to host, domain, or fleet compromise. jbig2dec is not an identity provider, hypervisor, backup agent, or network edge appliance. No high-value-role scenario produces domain takeover or fleet compromise, so the HIGH floor does not engage.

Why not higher?

To reach HIGH, the bug would need a demonstrated code-execution path, active exploitation, or deployment in a component where a crash itself constitutes fleet-scale impact (e.g., a kernel-mode agent or domain controller). None of those conditions are met. The impact ceiling is a single-process crash with automatic recovery, and there is zero evidence of weaponization or in-the-wild use.

Why not lower?

Despite the friction, jbig2dec *is* bundled in Ghostscript, which is installed on a significant fraction of Linux servers — document pipelines, print infrastructure, and CI systems all use it. A motivated attacker who can upload PDFs to a conversion endpoint can reliably crash it. The bug is trivially reproducible once a sample file is crafted, and the upstream fix references a real, confirmed integer overflow. LOW would understate the availability risk to document-processing infrastructure.

1. Disable JBIG2 decoding in Ghostscript if not needed — Set -dNOJBIG2 on Ghostscript command lines or policy files. Most enterprise PDF workloads use DCT/Flate, not JBIG2. This eliminates the code path entirely. No mitigation SLA applies at MEDIUM — go straight to your 365-day remediation window.
2. Sandbox document-processing pipelines — Run Ghostscript and MuPDF inside containers or nsjail/bubblewrap with seccomp profiles. A crash stays contained to one ephemeral container, and the orchestrator respawns it. This is defense-in-depth for all file-parsing bugs, not just this one.
3. Rate-limit and deduplicate PDF submissions — If you run a document-ingestion API, apply per-client rate limits and hash-based dedup. This prevents an attacker from repeatedly crashing the converter with the same payload to sustain a DoS.
4. Apply distro patches when available — Ubuntu has shipped fixes via USN-8582-1. RHEL, Debian, and SUSE typically follow within weeks. Use your normal patching cycle — no emergency window needed for a MEDIUM.

Run this on any Linux host where Ghostscript or jbig2dec is installed. No special privileges needed. Example: bash check_cve_2026_38076.sh

#!/usr/bin/env bash
# check_cve_2026_38076.sh — Detect vulnerable jbig2dec (CVE-2026-38076)
# Run on target host. No root required.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

# Ubuntu/Debian fixed versions per USN-8582-1
# 26.04: 0.20-1ubuntu0.26.04.1
# 24.04: 0.20-1ubuntu0.24.04.1
# 22.04: 0.19-3ubuntu0.1

check_dpkg() {
  local pkg="libjbig2dec0"
  if dpkg -s "$pkg" >/dev/null 2>&1; then
    local installed
    installed=$(dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null)
    echo "[*] Found $pkg version: $installed"
    # Check if version contains ubuntu patch suffix
    if echo "$installed" | grep -qE 'ubuntu0\.(26|24)\.04\.1|0\.19-3ubuntu0\.1|0\.2[1-9]'; then
      echo "PATCHED — $pkg $installed includes fix for CVE-2026-38076"
      exit 0
    else
      echo "VULNERABLE — $pkg $installed is likely affected by CVE-2026-38076"
      exit 1
    fi
  fi
  return 1
}

check_rpm() {
  local pkg="jbig2dec"
  if rpm -q "$pkg" >/dev/null 2>&1; then
    local installed
    installed=$(rpm -q --qf '%{VERSION}-%{RELEASE}' "$pkg" 2>/dev/null)
    echo "[*] Found $pkg version: $installed"
    echo "UNKNOWN — check your distro advisory for CVE-2026-38076 fix status"
    exit 2
  fi
  if rpm -q "jbig2dec-libs" >/dev/null 2>&1; then
    local installed
    installed=$(rpm -q --qf '%{VERSION}-%{RELEASE}' "jbig2dec-libs" 2>/dev/null)
    echo "[*] Found jbig2dec-libs version: $installed"
    echo "UNKNOWN — check your distro advisory for CVE-2026-38076 fix status"
    exit 2
  fi
  return 1
}

check_binary() {
  if command -v jbig2dec >/dev/null 2>&1; then
    local ver
    ver=$(jbig2dec --version 2>&1 | head -1 || true)
    echo "[*] jbig2dec binary version: $ver"
    echo "UNKNOWN — cannot confirm patch status from binary version alone"
    exit 2
  fi
  return 1
}

echo "=== CVE-2026-38076 Check (jbig2dec integer overflow) ==="

if check_dpkg 2>/dev/null; then exit; fi
if check_rpm 2>/dev/null; then exit; fi
if check_binary 2>/dev/null; then exit; fi

# Check if Ghostscript bundles jbig2dec
if command -v gs >/dev/null 2>&1; then
  gsver=$(gs --version 2>/dev/null || echo "unknown")
  echo "[*] Ghostscript $gsver found — may bundle vulnerable jbig2dec"
  echo "UNKNOWN — Ghostscript bundles jbig2dec internally; check vendor advisory"
  exit 2
fi

echo "[*] No jbig2dec or Ghostscript installation detected"
echo "PATCHED — jbig2dec not installed on this host"
exit 0

Sources

1. Ubuntu Security Notice USN-8582-1
2. CVE-2026-38076 disclosure gist (dkjsone)
3. CERT/CC VU#951662 — MuPDF integer overflow
4. CVE-2026-38076 — THREATINT
5. ArtifexSoftware/jbig2dec GitHub repository
6. Ghostscript third-party library dependencies
7. jbig2dec CVE history — CVEDetails