A crafted PDF can overflow Ghostscript's memory. The fix has been out since 8 September.
By Lior AharonovFounder, 7IT Solutions ·
Wordfence researchers found CVE-2026-39919 on 23 August, a heap buffer overflow in Ghostscript 9.21 through 10.07.1, triggered by a PDF with a crafted JPEG 2000 image. Artifex shipped the fix in 10.08.0 on 8 September, and BleepingComputer reported it on 13 October. Wordfence has not seen exploitation; its WordPress test reached remote code execution, but 10,240 lab runs on Linux packages did not.
Any feature that takes a PDF upload and makes a thumbnail may run it through Ghostscript. That upload form becomes the door. The lab results suggest it is hard to exploit reliably, which buys you time but not forever.
Upgrade Ghostscript to 10.08.0 or later, or check your distribution's backport notes. Rebuild Docker images on a patched base. If you cannot upgrade yet, block PDF uploads or disable PDF rendering in ImageMagick.
A library you never chose is still yours. Find out where PDFs get rendered in your stack today.
Lior Aharonov · my takeSources
- BleepingComputer: Ghostscript flaw lets hackers hijack servers via PDF uploads bleepingcomputer.com
Researched with AI tools; every fact is checked against the linked sources.