Critical Ghostscript Flaw Lets Attackers Use Malicious PDFs to Execute Code

A critical vulnerability in Ghostscript could allow attackers to use specially made PDF files to run code on vulnerable servers.

The flaw, tracked as CVE-2026-39919, affects Ghostscript versions before 10.08.0 and has a CVSS severity score of 9.8 out of 10. Ghostscript is widely used to render PDFs, create document thumbnails, and convert PostScript files into images.

The issue is especially important for websites and services that accept uploaded PDFs. WordPress sites, document portals, print services, email gateways, invoice platforms, and file-conversion APIs may all call Ghostscript behind the scenes when they process user-supplied files.

A malicious PDF can therefore reach the vulnerable component even when the main application has no direct Ghostscript code.

Researchers from Wordfence identified the vulnerability during a WordPress 7.1 security assessment using its Argus testing system.

This is not a malware campaign, and researchers have not reported active exploitation in the wild. Instead, the finding shows how a crafted PDF can trigger memory corruption and, in certain server builds, lead to unauthenticated remote code execution.

Wordfence reported the flaw to Artifex on August 23, and the vendor confirmed it the following day before releasing the fix on September 8.

Critical Ghostscript Flaw

CVE-2026-39919 is a heap-based buffer overflow in Ghostscript’s JPEG 2000 image decoding path. The issue occurs when Ghostscript processes a PDF containing a JPEG 2000 image with unusual component resolution settings and sub-byte sample values.

In simple terms, the program reserves too little memory for image data and then writes more data than the allocated buffer can hold.

That extra data can overwrite nearby memory used by Ghostscript. In a controlled WordPress test environment, Wordfence researchers showed that this memory corruption could be developed into remote code execution.

The code would run with the permissions assigned to the account that processes the PDF, such as a web server or PHP-FPM user, rather than automatically gaining root access.

The public NVD vulnerability record lists the issue as a heap-based buffer overflow and notes that crafted JPEG 2000 content inside a PDF can corrupt memory.

The risk starts when an application accepts a PDF and attempts to create a preview or thumbnail. On many WordPress setups, the chain is WordPress, Imagick, ImageMagick, and then Ghostscript. The site may appear to be processing a normal document upload, but Ghostscript is the lower-level tool that reads the file.

This is why the issue differs from the earlier WordPress Imagick code-execution flaw, where WordPress upload validation could be bypassed with content disguised as an image. In this case, the memory bug itself sits inside Ghostscript.

Affected Versions and Real-World Risk

The vulnerable code was introduced in Ghostscript 9.21 and affects upstream versions through 10.07.1. Artifex fixed the issue in Ghostscript 10.08.0, and its official Ghostscript CVE page confirms that CVE-2026-39919 was addressed in that release.

However, Linux vendors may backport the fix to an older-looking package version, meaning gs --version alone may not prove whether a server is safe.

Wordfence tested ten package environments, including Debian, Ubuntu, Fedora, AlmaLinux, Alpine Linux, and an official WordPress Docker image. The researchers found vulnerable builds across those environments during their September 15 tests.

Their proof-of-concept files did not work unchanged across all systems, which means there is no evidence of a single universal PDF that compromises every server. Still, a build-specific exploit continued to work on systems sharing the same Ghostscript executable.

That result matters for hosting providers and companies that deploy many servers from one container image. A threat actor may not need a PDF that works everywhere if several targets use the same vulnerable build.

The concern is similar to the recent malicious HEIC image research, which showed how native media-processing libraries can expose WordPress servers when uploaded files reach vulnerable decoders.

Organizations should install the fixed Ghostscript package provided by their operating system vendor or hosting provider. Teams using containers should rebuild images from an updated base image and redeploy them, rather than simply restarting an existing container.

Managed WordPress customers should ask their hosting provider whether its Ghostscript package includes the CVE-2026-39919 fix and whether uploaded PDFs are converted into previews.

Where updates cannot be installed immediately, administrators should stop untrusted users from uploading PDFs or disable PDF processing through ImageMagick policy settings.

Rate limits and upload limits can reduce repeated processing attempts, but they do not remove the underlying flaw. Ghostscript’s -dSAFER mode should also not be treated as a fix because Wordfence reached the vulnerable path while that sandbox setting was enabled.

The incident also adds to growing evidence that document and image conversion services need close review. A Discourse image pipeline chain recently showed how Ghostscript and ImageMagick can become part of a wider file-processing risk path.

While Claude-assisted decoder exploit research demonstrated how flaws in media libraries can be adapted for real service environments.

Indicators of compromise (IoCs):-

IoC Type	Value	Source Status	Defender Action
SHA-256 hash	Not disclosed	No malicious sample hash published	Do not block based on unverified hashes
Domain or IP address	Not disclosed	No command-and-control infrastructure reported	Review web and upload logs for unusual PDF activity
Malicious PDF filename	Not disclosed	Test files were not published as campaign indicators	Inspect unexpected PDF uploads and conversion failures
Vulnerability identifier	CVE-2026-39919	Publicly assigned	Confirm Ghostscript package is fixed
Fixed upstream version	Ghostscript 10.08.0	Released by Artifex	Update or apply vendor-backported package fix

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.