jbig2dec CVE-2026-38076

No vendor-released patched version is identified at time of analysis and the EUVD record does not name a fixed release, so the primary action is to track the upstream jbig2dec repository (https://github.com/ArtifexSoftware/jbig2dec) for a commit that adds overflow validation to jbig2_arith_iaid_ctx_new() past commit cc37d0, then rebuild or update any bundled copies in Ghostscript/MuPDF-based products. Until a fixed release is confirmed, compensating controls include disabling or sandboxing JBIG2 decoding where the format is not needed (for example running document conversion inside a resource-limited container or seccomp jail so a decoder crash cannot take down the host service), and rejecting or pre-filtering untrusted JBIG2/PDF input at the ingestion boundary; the trade-off is that sandboxing adds operational overhead and blocking JBIG2 breaks legitimate documents that rely on that compression. Because the impact is availability-only, restarting the worker/process and rate-limiting document submissions also limits blast radius.