Ghostscript CVE-2026-39919 (CVSS 9.8): crafted PDF with a JPEG 2000 image overflows a heap buffer, giving remote code execution on servers that render uploaded PDFs (WordPress thumbnails via ImageMagick); fixed in 10.08.0
Wordfence said on 12 October 2026 that its Argus AI system found CVE-2026-39919, a critical heap buffer overflow in the Ghostscript PostScript and PDF interpreter, during a WordPress 7.1 assessment on 23 August. A PDF containing a JPEG 2000 image with low-bit-depth samples and mismatched component resolutions makes Ghostscript write 1,024 bytes into a 256-byte buffer. Wordfence rates it 9.8 and turned it into unauthenticated remote code execution on a purpose-built WordPress test server, where WordPress calls ImageMagick through PHP Imagick to make a PDF thumbnail and ImageMagick launches Ghostscript. Ghostscript 9.21 to 10.07.1 contain the vulnerable code. In its 15 September tests, the Ghostscript packages in Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04, Fedora 44, AlmaLinux 10, Alpine and the official WordPress Docker image were all still affected. Its two exploits did not work against those stock packages in 10,240 attempts, but did work after changes to fonts, language settings and one system library, so exploitation depends on the environment. Stock WordPress does not allow anonymous Media Library uploads; an attacker needs some way to upload a PDF that the site then renders. Artifex fixed the flaw in Ghostscript 10.08.0 on 8 September and backported fixes to older lines. Wordfence has seen no exploitation in the wild. Any application that renders untrusted PDFs through Ghostscript is in scope, not only WordPress.
- Product
- Artifex Ghostscript (PostScript/PDF interpreter), often reached through ImageMagick / PHP Imagick for PDF previews
- Versions
- Vulnerable code in Ghostscript 9.21 through 10.07.1. Fixed upstream in 10.08.0 (8 Sep 2026); distribution packages may carry backported fixes, so check the package changelog for CVE-2026-39919.
- CVSS
- 9.8 (per Wordfence)
- Exploited in Australia?
- unknown
- Patch to
- Update Ghostscript to 10.08.0 or a distribution package that lists the CVE-2026-39919 fix, and rebuild container images from a patched base. Shared-hosting WordPress sites: ask your host to confirm. If you cannot update, stop rendering untrusted PDFs: block PDF uploads, or disable the PDF/PS coders in ImageMagick's policy.xml. Restrict who can upload files at all.
Primary: Wordfence — Argus discovers critical vulnerability in Ghostscript, the program that turns uploaded PDFs into thumbnails (12 Oct 2026) · Vendor: Artifex Ghostscript — release news (10.08.0, 8 Sep 2026) · CVE: CVE-2026-39919 · BleepingComputer — Ghostscript flaw lets hackers hijack servers via PDF uploads (13 Oct 2026)