Critical Ghostscript flaw enables remote code execution via PDF uploads
CVE-2026-39919, a heap buffer overflow in Ghostscript versions 9.21 through 10.07.1, allows unauthenticated remote code execution when processing malicious PDFs, impacting systems like WordPress and Wikipedia.
A critical heap buffer overflow vulnerability in Ghostscript enables unauthenticated remote code execution via malicious PDF uploads. Designated CVE-2026-39919, the flaw was discovered on August 23 by researchers at Wordfence using their Argus AI-powered system.
Ghostscript is a widely used PostScript and PDF interpreter. It renders PDFs as images, generates thumbnails for previews, and optimizes PDF files. In a common web workflow, WordPress can use the PHP Imagick extension to call ImageMagick, which then launches Ghostscript to process a PDF for a thumbnail.
The vulnerability resides in Ghostscript’s JPEG 2000 output adapter. A specially crafted PDF file containing a JPEG 2000 image can trigger incorrect handling of low-bit-depth samples and mismatched component resolutions. This corrupts chunk-allocator metadata. Researchers developed two exploits that force Ghostscript to write 1,024 bytes into a 256-byte buffer, corrupting nearby memory and leading to remote code execution.
Exploitation conditions and testing
The flaw affects Ghostscript versions 9.21 through 10.07.1. Exploit success depends heavily on the target environment and system libraries. Wordfence focused on WordPress but notes any online system running a vulnerable Ghostscript version is potentially at risk if the payload is adjusted.
The team tested ten Linux environments, including Debian, Ubuntu, Fedora, Alpine, and AlmaLinux, as well as an official WordPress Docker image snapshot. All contained the vulnerable code. In a lab testbed, they executed the exploits 10,240 times against Linux packages but failed to achieve remote code execution. They succeeded only on a purpose-built test server after modifying the PDF's fonts, language settings, font configuration, and a core system library.
For WordPress, successful exploitation has four prerequisites. An attacker must be able to upload a PDF, either anonymously or through a low-privileged account. The site must then process that PDF to generate a preview or thumbnail. The processing chain must reach Ghostscript, with the necessary software and policy settings permitting PDF rendering. Finally, Ghostscript must contain the unpatched vulnerable decoding code. Wordfence noted that "stock WordPress does not permit anonymous Media Library uploads."
More broadly, any application that renders attacker-supplied PDFs through affected Ghostscript code may expose the flaw. Authentication requirements for exploitation depend entirely on the specific application.
Mitigation and patching guidance
Artifex, the maintainer of Ghostscript, rolled out a fix on September 8 in version 10.08.0. Fixes were also backported to older versions. Server administrators should update Ghostscript to version 10.08.0 immediately.
WordPress administrators need to ensure, through their hosting provider, that Ghostscript has been upgraded. If using Docker, it is recommended to rebuild and redeploy with an updated, patched base image. If unable to upgrade to a fixed release, administrators should block PDF uploads to the server or disable PDF rendering in ImageMagick. Teams should also sandbox any service that processes untrusted documents and disable PostScript handling in ImageMagick’s policy.xml where possible.
Broader impact and related vulnerabilities
The same Ghostscript version 10.08.0 patches two additional critical flaws. Major platforms using Ghostscript through ImageMagick include Wikipedia, Steam, Microsoft OneDrive, and Mozilla’s Pocket service.
| CVE Identifier | CVSS Score | Description |
|---|---|---|
| CVE-2026-101258 | 8.5 | Allows bypassing Ghostscript’s -dSAFER sandbox entirely via chained vulnerabilities, enabling direct shell command execution. A proof-of-concept exploit is on GitHub. |
| CVE-2026-103226 | Not specified | Targets the Pdfwrite component via a stack-based buffer overflow. A public exploit exists and might be used. |
ImageMagick identifies files by content rather than extension. This means an attacker can rename a malicious PostScript file as a .jpg image and ImageMagick will still send it to Ghostscript for processing.
Red Hat shipped fixes for RHEL 8, 9, and 10 between October 1 and October 6. SUSE released an advisory on October 8 rating CVE-2026-39919 as 'important'. Debian Bookworm and several Amazon Linux releases still show pending fixes.
A separate Windows-specific vulnerability, CVE-2026-108693, affects ImageMagick. It allows attackers to plant a malicious Ghostscript executable that runs with ImageMagick’s privileges during PDF conversion.
Current status and defender recommendations
CVE-2026-39919 has a CVSS v4 score of 9.3. Despite the high severity and exploit availability, Wordfence said "it has not seen any in-the-wild exploitation of CVE-2026-39919 yet."
Defenders must prioritize patching given the potential impact across major platforms. Restricting untrusted document processing remains a critical control. Server administrators should update Ghostscript to version 10.08.0 immediately.
