Critical Ghostscript PDF flaw CVE-2026-39919 patched in 10.08.0
Wordfence disclosed Ghostscript heap overflow CVE-2026-39919, fixed in 10.08.0, with lab PDF code execution and no known wild exploitation.
Wordfence Threat Intelligence, using Wordfence Argus, disclosed CVE-2026-39919, a critical heap buffer overflow in Ghostscript rated CVSS 9.8. BleepingComputer reports that Ghostscript 9.21 through 10.07.1 is affected and that a crafted PDF containing a JPEG 2000 image can trigger the bug; Wordfence said its proofs of concept wrote past a memory buffer, and BleepingComputer specifies a write of 1,024 bytes into a 256-byte buffer. Wordfence achieved unauthenticated remote code execution on a purpose-built WordPress test site that rendered PDFs through Imagick, ImageMagick, and Ghostscript. BleepingComputer adds that attempts against standard Linux packages failed, which aligns with Wordfence's statement that its two proofs of concept were specific to particular builds. Artifex confirmed the report and shipped the fix in Ghostscript 10.08.0 on September 8, 2026. Both sources say exploitation has not been observed in the wild, and Wordfence says site owners must update the operating-system package or rebuild containers because there is no WordPress plugin to patch.
- CVE-2026-39919 is a CVSS 9.8 heap buffer overflow in Ghostscript, found by Wordfence Threat Intelligence using Wordfence Argus.
- BleepingComputer says affected versions are Ghostscript 9.21 through 10.07.1, and a crafted PDF containing a JPEG 2000 image can trigger the overflow.
- Wordfence's proofs of concept wrote past a memory buffer; BleepingComputer specifies a write of 1,024 bytes into a 256-byte buffer.
- Unauthenticated remote code execution was shown on a purpose-built WordPress test site rendering PDFs through Imagick, ImageMagick, and Ghostscript, while attempts against standard Linux packages failed and the proofs of concept were…
- Artifex confirmed the report and fixed the flaw in Ghostscript 10.08.0 on September 8, 2026.
- Neither source reported confirmed in-the-wild exploitation.
- Fixes ship through operating-system packages or rebuilt containers, not a WordPress plugin; any app sending untrusted PDFs to affected builds may be exposed.
Coverage timelineoldest first · each row is one article
- · 4d agoWordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server
Wordfence· 68
Wordfence disclosed Ghostscript CVE-2026-39919, a CVSS 9.8 flaw fixed in 10.08.0, with lab PDF remote code execution.
- · 3d agoGhostscript flaw lets hackers hijack servers via PDF uploads
BleepingComputer· 68
Ghostscript heap overflow CVE-2026-39919 can enable remote code execution through crafted PDF uploads, with no exploitation seen yet.
Vulnerabilities in this storyAll →
- CVE-2026-399199.3—Heap Buffer Overflow in Ghostscript JPEG 2000 Output Path Enables RCEpublished · Artifex Software Ghostscript
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-39919 | Heap Buffer Overflow in Ghostscript JPEG 2000 Output Path Enables RCE Ghostscript versions before 10.08.0 contain a heap-based buffer overflow in the JPEG 2000 output adapter (base/sjpx_openjpeg.c). When a crafted PDF embeds a JPEG 2000 image whose components declare mismatched subsampling factors, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata. Successful exploitation allows an attacker who can supply a document to the parser to achieve code execution with the privileges of the Ghostscript process, which is rated critical (CVSS 4.0: 9.3, network vector, no privileges or user interaction required). Any system or service that processes untrusted PDFs or images through Ghostscript is affected. No public proof-of-concept is known and the flaw is not listed in CISA's KEV, so exploitation is not currently observed. |