Ghostscript flaw enables remote code execution through crafted PDFs

A critical heap buffer overflow in Ghostscript could let attackers run code remotely by sending specially crafted PDF files to systems that process them. The vulnerability is tracked as CVE-2026-39919.

Researchers at Defiant’s Wordfence platform discovered the flaw on August 23 using its Argus AI-powered system. A PDF containing a JPEG 2000 image can trigger incorrect handling of low-bit-depth samples and mismatched component resolutions. In their exploit, Ghostscript writes 1,024 bytes into a 256-byte buffer, corrupting nearby memory.

Wordfence demonstrated unauthenticated remote code execution on a purpose-built test server. The researchers tested the exploits 10,240 times against Linux packages in a lab but did not achieve remote code execution there. They said success depended on the target environment and was not reliable. The flaw affects Ghostscript versions 9.21 through 10.07.1; Wordfence found vulnerable code in ten tested Linux environments and a WordPress Docker image snapshot.

In WordPress, exploitation depends on how an application handles attacker-supplied PDFs. Wordfence noted that stock WordPress does not allow anonymous Media Library uploads. The maintainers, Artifex, released a fix in Ghostscript 10.08.0 on September 8 and backported fixes to older versions. Wordfence said it had not seen in-the-wild exploitation of CVE-2026-39919.