Ghostscript (Product): news timeline & CVEs

Ghostscript flaw lets hackers hijack servers via PDF uploads

Ghostscript heap overflow CVE-2026-39919 can enable remote code execution through crafted PDF uploads, with no exploitation seen yet.

Wordfence researchers found CVE-2026-39919, a critical heap buffer overflow in Ghostscript 9.21 through 10.07.1 that can be triggered by a crafted PDF containing a JPEG 2000 image. Their proofs of concept wrote 1,024 bytes into a 256-byte buffer and achieved remote code execution on a purpose-built test server, although attempts against standard Linux packages failed. Artifex patched the issue in Ghostscript 10.08.0 on September 8, and Wordfence says it has not observed exploitation in the wild.

BleepingComputerOct 13, 21:33 UTC · 3d agoVulnerability 2 sources CVE-2026-399192· 1 read

Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server

Wordfence disclosed Ghostscript CVE-2026-39919, a CVSS 9.8 flaw fixed in 10.08.0, with lab PDF remote code execution.

Wordfence Threat Intelligence, using Wordfence Argus, found a critical heap buffer overflow in Ghostscript tracked as CVE-2026-39919 with a CVSS score of 9.8. Artifex confirmed the report and shipped the fix in Ghostscript 10.08.0 on September 8, 2026. A crafted PDF containing a JPEG 2000 image can write past a memory buffer, and Wordfence turned that into unauthenticated remote code execution on a purpose-built WordPress test site that rendered PDFs through Imagick, ImageMagick, and Ghostscript. The company said its two proofs of concept were specific to particular builds and did not report confirmed in-the-wild exploitation. Site owners must update the operating-system package or rebuild containers; there is no WordPress plugin to patch.

Wordfenceupdated Oct 13, 21:33 UTC · 3d agofirst Oct 12, 18:10 UTC · 4d agoVulnerability 2 sources CVE-2026-39919

Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads

Researchers disclosed CVE-2026-55420, letting low-privilege Discourse users read server files via ImageMagick uploads.

Searchlight Cyber disclosed CVE-2026-55420, a critical flaw in default Discourse Docker deployments. A Trust Level 0 user can upload a polyglot file that passes image checks, then win a TOCTOU race so ImageMagick, Ghostscript, and Magick Scripting Language read or write local files such as /etc/passwd. Hosted customers were fixed in June 2026, with public disclosure on June 30. Discourse now uses a default-deny ImageMagick policy that blocks unsafe delegates, including Ghostscript.

GBHackersOct 12, 11:13 UTC · 4d agoVulnerability 2 sources CVE-2026-554203· 2 reads

Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read

Searchlight Cyber showed a patched Discourse upload chain letting basic users read server files via ImageMagick.

Searchlight Cyber reported a Discourse image-upload chain that let a Trust Level 0 user read server files on default configurations by combining a slow JPEG, a time-of-check to time-of-use race, Ghostscript, and ImageMagick's MSVG and MSL handling. A second bug reflected an unchecked color-scheme cookie into cached HTML and could load attacker JavaScript for anonymous visitors, bypassing CSP. Both issues were reported in June 2026 and patched before publication. CVE-2026-55420 lists fixes in Discourse 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, though its advisory describes a narrower non-default PDF case. Discourse is used by more than 22,000 communities.

Cyber Security Newsupdated Oct 12, 11:13 UTC · 4d agofirst Oct 12, 06:43 UTC · 4d agoVulnerability 2 sources CVE-2026-554202

USN-8791-1: Ghostscript vulnerability

A Ghostscript vulnerability in JPEG 2000 image processing could allow arbitrary code execution via crafted files.

A vulnerability in Ghostscript was discovered where incorrect handling of JPEG 2000 image components with mismatched subsampling factors could allow an attacker to cause a crash or execute arbitrary code. Ubuntu has issued a security notice (USN-8791-1) for the flaw. The issue is triggered when processing specially crafted image files.

Ubuntu Security NoticesSep 21, 12:51 UTC · 25d agoVulnerability1

Ghostscript

Timeline5 articles

Related CVEsby mentions

Appears with

Ghostscript flaw lets hackers hijack servers via PDF uploads

Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server

Discourse ImageMagick Vulnerability Enables Arbitrary File Read Through Malicious Image Uploads

Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read

USN-8791-1: Ghostscript vulnerability