Critical Ghostscript flaw could let attackers hijack servers via uploaded PDFs

A critical heap buffer overflow in Ghostscript, the widely used PostScript and PDF interpreter, could let attackers run code on servers that process uploaded PDF files, BleepingComputer reported on October 13. The flaw, tracked as CVE-2026-39919, was found by researchers at Wordfence. It affects a component that many web applications rely on, often without administrators realizing it, to generate document previews and thumbnails.

What happened

According to BleepingComputer, Wordfence researchers discovered the vulnerability on August 23 using their AI-powered Argus system. Ghostscript maintainer Artifex released a fix in version 10.08.0 on September 8 and backported it to older release branches. Affected versions range from 9.21 through 10.07.1.

Wordfence says it has not observed any exploitation in the wild.

Technical details

The bug is triggered by a PDF that embeds a JPEG 2000 image, causing Ghostscript to mishandle low-bit-depth samples and mismatched component resolutions. In Wordfence's proof-of-concept exploits, Ghostscript writes 1,024 bytes into a 256-byte buffer, corrupting adjacent memory.

BleepingComputer reports that exploitation is not straightforward. In lab testing, the exploits ran 10,240 times against standard Linux packages without achieving code execution. They succeeded only on a purpose-built test server, and changes to fonts, language settings, font configuration and a core system library improved the odds, though not reliably. Wordfence nonetheless warns that any internet-facing system running a vulnerable version is at risk if an attacker tailors the payload to the environment.

Wordfence tested ten Linux environments, including Debian, Ubuntu, Fedora, Alpine and AlmaLinux, along with an official WordPress Docker image snapshot. All of them contained the vulnerable code.

Who is affected

WordPress is the main concern. Thumbnail generation can pass through PHP's Imagick extension to ImageMagick, which in turn launches Ghostscript, potentially resulting in unauthenticated remote code execution. Per Wordfence, a successful attack on WordPress requires that an attacker can upload a PDF, either anonymously or through a low-privileged account, and that the site processes the file to create a preview. The processing chain must also reach Ghostscript with settings that permit PDF rendering, and the installed Ghostscript must be unpatched. Wordfence notes that stock WordPress does not allow anonymous Media Library uploads, but plugins and custom forms may.

Other applications that render user-supplied PDFs on the server through ImageMagick or Ghostscript may also be exposed.

What to do

Wordfence recommends upgrading Ghostscript to 10.08.0 or later, or confirming that a backported fix has been applied by checking the package revision. Sites on shared hosting should ask their provider to update. Docker deployments should be rebuilt and redeployed from a patched base image. If upgrading is not immediately possible, administrators can block PDF uploads or disable PDF rendering in ImageMagick's policy until the fix is in place.