Ghostscript flaw lets hackers hijack servers via PDF uploads
Ghostscript heap overflow CVE-2026-39919 can enable remote code execution through crafted PDF uploads, with no exploitation seen yet.
Wordfence researchers found CVE-2026-39919, a critical heap buffer overflow in Ghostscript 9.21 through 10.07.1 that can be triggered by a crafted PDF containing a JPEG 2000 image. Their proofs of concept wrote 1,024 bytes into a 256-byte buffer and achieved remote code execution on a purpose-built test server, although attempts against standard Linux packages failed. Artifex patched the issue in Ghostscript 10.08.0 on September 8, and Wordfence says it has not observed exploitation in the wild.
68