Critical Ghostscript Vulnerability (CVE-2026-39919) Allows Remote Code Execution
Wordfence has discovered a critical heap buffer overflow vulnerability in Ghostscript, a widely used document processing engine, that can lead to unauthenticated remote code execution.
A critical vulnerability, tracked as CVE-2026-39919 and assigned a CVSS score of 9.8, has been discovered in Ghostscript, a powerful document processing engine. The vulnerability, a heap buffer overflow, was found by the Wordfence Threat Intelligence team and allows for unauthenticated remote code execution when a specially crafted PDF is processed.
The vulnerability arises from how Ghostscript handles JPEG 2000 images within PDF files. A malicious PDF can cause Ghostscript to write attacker-controlled data beyond the allocated memory buffer, leading to memory corruption. This corruption can then be exploited to achieve remote code execution on the affected system. Wordfence successfully demonstrated this exploit on a purpose-built WordPress test site.
Ghostscript is a fundamental component for many applications that need to convert documents like PDFs into images, such as generating thumbnails. While WordPress itself does not render PDF previews, it can leverage Ghostscript through extensions like PHP Imagick and ImageMagick when creating attachment metadata for uploaded PDFs. This means that any application processing untrusted PDFs through an affected Ghostscript instance is potentially at risk, including document management systems, print services, invoice processors, and mail gateways.
The fix for this critical vulnerability is available in Ghostscript version 10.08.0, released by Artifex on September 8, 2026. However, users should be aware that the specific version of Ghostscript installed often depends on their operating system distribution or container image. Therefore, simply checking the gs --version output might not be sufficient; the full package revision is crucial. Containerized environments, such as Docker, require rebuilding and redeploying from an updated base image.
Wordfence's testing indicated that while the exploit is not a universal, single-file solution across all Ghostscript builds, the exact build of the software is important. Proof-of-concept exploits developed for one specific build did not work on other tested Linux package environments or the official WordPress Docker image. This suggests that targeted attacks might be more feasible, especially on hosting platforms where multiple sites might share the same vulnerable Ghostscript build.
While the CVSS score of 9.8 highlights the potential severity, it represents a worst-case scenario. Successful exploitation runs with the privileges of the user account processing the PDF, not necessarily root access. Modern system protections like memory randomization can sometimes turn memory corruption into a crash rather than code execution, but they do not fix the underlying bug. Despite these protections, Wordfence was able to achieve code execution on their test system.
Users running WordPress sites should not look for a plugin update, as Ghostscript is typically a system-level dependency. The recommended action is to ensure the system package providing Ghostscript is updated to a patched version or to rebuild containers from an updated base image. Following vendor or hosting provider guidance for restarting services after the update is also essential. The vulnerability underscores the importance of keeping underlying system components updated, even when they are not directly exposed to end-users.
This discovery by Wordfence Argus highlights the ongoing need for vigilance in securing the software supply chain and the critical dependencies that power web applications. The widespread use of Ghostscript means that this vulnerability could affect a significant number of servers and applications beyond just WordPress, making prompt patching a high priority for system administrators and security teams.