Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Critical Ghostscript Flaw CVE-2026-39919 Turns Uploaded PDFs Into a Code-Execution Risk

A heap overflow in Ghostscript's JPEG 2000 decoder (CVSS 9.8) lets a crafted PDF corrupt memory and, on some builds, run code on servers that preview uploaded documents. No in-the-wild exploitation yet. Patch to 10.08.0 or your vendor's fixed build.

4T4Tify Team4Tify
Oct 13, 2026·5 min read
Critical Ghostscript Flaw CVE-2026-39919 Turns Uploaded PDFs Into a Code-Execution Risk

Ghostscript CVE-2026-39919: a malicious PDF can become code execution on your server

If your website, portal or API turns uploaded PDFs into previews or thumbnails, there's a good chance Ghostscript is doing the work behind the scenes. A newly disclosed flaw, CVE-2026-39919 (CVSS 9.8), means a specially crafted PDF can corrupt Ghostscript's memory and, on some server builds, give an attacker code execution without logging in.

What happened

Researchers at Wordfence found the bug while assessing WordPress 7.1. It sits in Ghostscript's JPEG 2000 decoding path. A PDF that embeds a JPEG 2000 image with unusual component-resolution settings and sub-byte sample values makes Ghostscript allocate a buffer that's too small. It then writes past the end of that buffer: a classic heap-based buffer overflow.

  • Affected: upstream Ghostscript 9.21 through 10.07.1 (the vulnerable code goes back to 9.21).
  • Fixed: Ghostscript 10.08.0, released by Artifex on 8 September after Wordfence reported the issue on 23 August.
  • Exploitation status: no active exploitation and no malware campaign have been reported. The remote code execution was demonstrated in a controlled WordPress test environment.

The usual route in is a document preview. On many WordPress sites, an uploaded PDF goes from WordPress to Imagick to ImageMagick and finally to Ghostscript. The application never calls Ghostscript itself, but it still hands the attacker's file to the vulnerable decoder.

Why it matters

  • The exposure is bigger than WordPress. Document portals, print services, email gateways, invoicing platforms and file-conversion APIs often depend on Ghostscript without saying so.
  • Version strings can mislead you. Linux distributions often backport fixes, so gs --version alone doesn't tell you whether a host is safe. Check your distribution's security advisory for the package build you actually run.
  • Fleets share risk. Wordfence found vulnerable builds in all ten package environments it tested, including Debian, Ubuntu, Fedora, AlmaLinux, Alpine and the official WordPress Docker image. Their proof of concept needed tuning for each build, so there's no evidence of a single PDF that compromises every server. But an exploit that works on one build should work on every server running that same executable. That matters for hosting providers and anyone deploying many servers from one container image.
  • The impact is bounded, but still serious. Code runs with the privileges of the account that processes the file, such as the web server or PHP-FPM user, not root. That is still enough to deface a site, steal data the application can read, or move further into the network.

What to do

  1. Patch through your vendor. Install the fixed Ghostscript package from your OS vendor or hosting provider (upstream 10.08.0 or a vendor build with the backported fix).
  2. Rebuild containers, don't just restart them. Rebuild images from an updated base image and redeploy them. Restarting a container keeps the vulnerable binary.
  3. Ask your host. On managed WordPress, ask your provider whether its Ghostscript package includes the CVE-2026-39919 fix and whether uploaded PDFs are turned into previews.
  4. Mitigate if you can't patch yet. Stop untrusted users from uploading PDFs, or turn off PDF processing in ImageMagick's policy.xml.
  5. Don't rely on false comfort. Rate limits and upload caps reduce attempts but don't remove the flaw. Ghostscript's -dSAFER mode is not a fix either: the vulnerable path was reached with it enabled.
  6. Watch the pipeline. No hashes, filenames or command-and-control infrastructure have been published, so don't block on unverified indicators. Instead, check upload and web logs for unexpected PDF uploads and spikes in document-conversion failures.

Not sure where Ghostscript runs in your environment? A dependency and attack-surface review will find every service that converts user files. These pipelines are easy to forget, and bugs like this one target them.

Reporting credit: this story was first covered by Cyber Security News; the underlying research is by Wordfence. Technical reference: NVD — CVE-2026-39919.

SHARE