Ghostscript Flaw Enables Potential Remote Code Execution via Crafted PDFs
Summary
CVE-2026-39919 is a Ghostscript heap overflow that can enable remote code execution when affected systems process crafted PDFs. Ghostscript 10.08.0 fixes the flaw; Wordfence reported no known in-the-wild exploitation.
Key points
- The flaw affects Ghostscript versions 9.21 through 10.07.1 and can be triggered by a crafted PDF containing a JPEG 2000 image.
- In WordPress, exploitation may be possible when an attacker can upload a PDF and the site processes it through a Ghostscript-enabled rendering chain.
- Wordfence demonstrated remote code execution on a purpose-built test server, but not in repeated tests against ten Linux environments; success depended on the environment.
- Successful WordPress exploitation requires PDF upload access, PDF preview or thumbnail processing, permissive rendering settings, and vulnerable Ghostscript code.
- Artifex released a fix in Ghostscript 10.08.0 on September 8 and backported fixes to older versions.
- Administrators should upgrade Ghostscript or rebuild Docker deployments with a patched base image; if unable to patch, block PDF uploads or disable PDF rendering in ImageMagick.
- Wordfence said it had not observed exploitation in the wild.
Article Details
- Vulnerability Types
- Heap buffer overflow
- Remote code execution
- Severity
- Critical
- Affected Versions
- Ghostscript 9.21 through 10.07.1
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Block PDF uploads to the server.
- Disable PDF rendering in ImageMagick.
MITRE ATT&CK
CVE
Vendors
Products
DockerThe researchers tested ten Linux environments, including Debian, Ubuntu, Fedora, Alpine, and AlmaLinux, as well as an official WordPress Docker image snapshot, and found that all contained the vulnerable code.GhostscriptGhostscript flaw lets hackers hijack servers via PDF uploadsImageMagickWhen generating a PDF thumbnail, WordPress can use the PHP Imagick extension to call ImageMagick, which launches Ghostscript.ImagickWhen generating a PDF thumbnail, WordPress can use the PHP Imagick extension to call ImageMagick, which launches Ghostscript.WordPressWhen generating a PDF thumbnail, WordPress can use the PHP Imagick extension to call ImageMagick, which launches Ghostscript.