Ghostscript, the PostScript and PDF engine that many servers use behind the scenes to render PDF previews and thumbnails, has a critical heap buffer overflow, CVE-2026-39919 (CVSS 9.8). Researchers at Wordfence found it on August 23 with their Argus AI system. A crafted PDF containing a JPEG 2000 image with low-bit-depth samples and mismatched component resolutions makes Ghostscript write 1,024 bytes into a 256-byte buffer. Artifex fixed it on September 8 in Ghostscript 10.08.0, with fixes also backported to older branches.
Wordfence built two exploits and reached unauthenticated remote code execution on a purpose-built WordPress test server, where an upload triggers thumbnail generation through the PHP Imagick extension, ImageMagick and then Ghostscript. It was not easy: against stock Linux packages, 10,240 attempts did not achieve code execution, and success required tuning fonts, language settings, font configuration and a core system library, and was not reliable. Wordfence has not seen exploitation in the wild, and stock WordPress does not allow anonymous Media Library uploads. But any application that renders attacker-supplied PDFs through the vulnerable code may be exposed, and Wordfence found all ten Linux environments it tested (Debian, Ubuntu, Fedora, Alpine, AlmaLinux) and an official WordPress Docker image contained the vulnerable code.
How to check if you’re affected
Affected versions are Ghostscript 9.21 through 10.07.1. Run gs --version on the server (or inside your container) and compare it with 10.08.0 or later, bearing in mind that distributions backport fixes, so check your package’s changelog for CVE-2026-39919 rather than relying on the number alone.
On WordPress, exploitation needs four things: someone can upload a PDF (anonymously or with a low-privilege account), the site generates a preview or thumbnail, that processing reaches Ghostscript, and the Ghostscript is unpatched. Ask your host to upgrade Ghostscript to 10.08.0 or later. With Docker, rebuild and redeploy from an updated base image. If you cannot upgrade, block PDF uploads or disable PDF rendering in ImageMagick.
Sources
- Wordfence Threat Intelligence research on CVE-2026-39919 (report not linked here; cited by name)
- BleepingComputer: Ghostscript flaw lets hackers hijack servers via PDF uploads