GoKawiilGhostscript flaw CVE-2026-39919 enables remote code execution via crafted PDFs
Wordfence researchers using their Argus AI system found a critical heap buffer overflow in Ghostscript, the PostScript/PDF rendering engine used by tools like ImageMagick and WordPress's thumbnail generator. A malicious PDF embedding a JPEG 2000 image can force Ghostscript to write far more data than a buffer can hold, corrupting memory and allowing unauthenticated remote code execution. The bug affects Ghostscript versions 9.21 through 10.07.1 and was confirmed present across ten tested Linux distributions and an official WordPress Docker image.
GoKawiil's interpretation of the reporting above, not reported fact.
Because Ghostscript underpins PDF handling in countless web applications beyond WordPress, the flaw's reach could extend to any server that processes user-uploaded PDFs through ImageMagick or similar libraries. Wordfence's tests suggest exploitation success depends heavily on specific environment configurations, which may explain why real-world attacks could be inconsistent but still dangerous once attackers tailor payloads. The researchers' use of an AI-assisted vulnerability discovery tool also points to how automated systems are increasingly surfacing complex memory-corruption bugs in widely used open-source software.
- CVE-2026-39919 is a heap buffer overflow in Ghostscript allowing remote code execution via malicious PDFs.
- It affects Ghostscript 9.21–10.07.1 and was found in all ten tested Linux distributions plus an official WordPress Docker image.
- Exploit success varied by environment, with researchers achieving RCE only after tailoring fonts, language settings and system libraries.
Source: bleepingcomputer.com, 2026-10-13
Published there as: “Ghostscript flaw lets hackers hijack servers via PDF uploads”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.