Critical Ghostscript Vulnerability (CVE-2026-39919) Enables Remote Code Execution via Malicious PDFs
A severe heap-based buffer overflow vulnerability in Ghostscript, tracked as CVE-2026-39919, allows unauthenticated attackers to execute arbitrary code on vulnerable systems by uploading a specially crafted PDF containing a malicious JPEG 2000 image. The flaw, rated 9.8 (CVSS v3.1) and 9.3 (CVSS v4.0), was discovered by Wordfence Threat Intelligence during a WordPress 7.1 security assessment and privately reported to Artifex, which released a patch in Ghostscript 10.08.0 on September 8, 2026.
The vulnerability resides in Ghostscript’s JPEG 2000 output adapter, where mismatched subsampling factors in image components cause a memory allocation mismatch. The affected code writes full bytes for each output column, regardless of bit depth, leading to a heap buffer overflow that corrupts internal memory-management metadata. Under specific conditions, this can be exploited for remote code execution (RCE).
Wordfence researchers demonstrated the attack by uploading a malicious PDF to a WordPress Media Library, where the document-processing chain Imagick → ImageMagick → Ghostscript automatically renders a preview. While WordPress itself is not directly exploited, the flaw exposes systems that accept PDF uploads from untrusted sources, including document portals, invoice-processing systems, file-conversion APIs, and print services.
Exploitation is build-specific, meaning proof-of-concept attacks may not work universally across all environments. However, attackers can target known software builds, shared container images, or common hosting setups. Wordfence’s testing confirmed that the official WordPress Docker image contained a vulnerable Ghostscript version, though stock WordPress does not allow anonymous PDF uploads by default plugins, custom forms, or authenticated user roles can introduce the attack surface.
Remediation requires patching at the OS or container level, as no WordPress plugin update addresses the issue. Administrators must install the fixed Ghostscript package from their Linux distribution, restart services, and rebuild containers from updated base images. Organizations unable to patch immediately should suspend untrusted PDF uploads or disable PDF rendering in ImageMagick’s security policy.
The incident underscores a broader supply-chain risk: a seemingly routine file-upload feature can trigger a chain of dependencies (e.g., WordPress → Imagick → ImageMagick → Ghostscript), turning a vulnerability in a low-level component into a server compromise risk.
Source: https://gbhackers.com/ghostscript-vulnerability/
Artifex Software cybersecurity rating report: https://www.rankiteo.com/company/artifexsoftware
"id": "ART1791894276",
"linkid": "artifexsoftware",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Web Development, Content Management',
'name': 'WordPress (via '
'Imagick/ImageMagick/Ghostscript dependency)',
'type': 'Software/CMS'},
{'industry': 'Software Development',
'name': 'Artifex (Ghostscript maintainer)',
'type': 'Software Vendor'}],
'attack_vector': 'Malicious PDF upload via JPEG 2000 image',
'data_breach': {'file_types_exposed': 'PDF, JPEG 2000'},
'date_detected': '2026-09-08',
'date_publicly_disclosed': '2026-09-08',
'description': 'A severe heap-based buffer overflow vulnerability in '
'Ghostscript, tracked as CVE-2026-39919, allows '
'unauthenticated attackers to execute arbitrary code on '
'vulnerable systems by uploading a specially crafted PDF '
'containing a malicious JPEG 2000 image. The flaw was '
'discovered during a WordPress 7.1 security assessment and '
'patched in Ghostscript 10.08.0 on September 8, 2026.',
'impact': {'operational_impact': 'Potential server compromise, unauthorized '
'code execution',
'systems_affected': 'Systems accepting PDF uploads (document '
'portals, invoice-processing systems, '
'file-conversion APIs, print services)'},
'investigation_status': 'Patched (Ghostscript 10.08.0 released)',
'lessons_learned': 'The incident highlights supply-chain risks where a '
'vulnerability in a low-level component (Ghostscript) can '
'lead to server compromise via dependency chains (e.g., '
'WordPress → Imagick → ImageMagick → Ghostscript).',
'post_incident_analysis': {'corrective_actions': 'Patch Ghostscript, disable '
'PDF rendering in '
'ImageMagick’s security '
'policy, rebuild containers '
'from updated base images.',
'root_causes': 'Heap-based buffer overflow in '
'Ghostscript’s JPEG 2000 output '
'adapter due to mismatched '
'subsampling factors and memory '
'allocation mismatch.'},
'recommendations': 'Patch Ghostscript immediately, disable untrusted PDF '
'uploads if patching is not feasible, and audit dependency '
'chains for similar risks.',
'references': [{'source': 'Wordfence Threat Intelligence'},
{'source': 'Artifex Ghostscript Patch Notes'}],
'response': {'containment_measures': 'Suspend untrusted PDF uploads, disable '
'PDF rendering in ImageMagick’s security '
'policy',
'remediation_measures': 'Patch Ghostscript to version 10.08.0 or '
'later, restart services, rebuild '
'containers from updated base images',
'third_party_assistance': 'Wordfence Threat Intelligence'},
'title': 'Critical Ghostscript Vulnerability (CVE-2026-39919) Enables Remote '
'Code Execution via Malicious PDFs',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'CVE-2026-39919 (Heap-based buffer overflow in '
"Ghostscript's JPEG 2000 output adapter)"}