Ghostscript vulnerability puts PDF uploads at risk
A Ghostscript vulnerability fixed in version 10.08.0 can let a crafted PDF trigger code execution in some server setups that turn uploaded PDFs into previews or thumbnails. Artifex released the fixed Ghostscript build on September 8, 2026, after Wordfence Threat Intelligence, using Wordfence Argus, reported the flaw sixteen days earlier. The issue is tracked as CVE-2026-39919, with a Common Vulnerability Scoring System score of 9.8 out of 10 for CVSS 3.1 and 9.3 for CVSS 4.0.
Ghostscript is a document engine, meaning software that reads PDF and PostScript files and converts pages into images for previewing, printing or display. Many site owners never install it directly and may not know it is present, because other tools call it in the background. In WordPress, core has been able since version 4.7 to create an image from the first page of a PDF when attachment metadata is generated. On servers using the PHP Imagick extension, WordPress calls ImageMagick, and ImageMagick then launches Ghostscript. The chain is WordPress, Imagick, ImageMagick, Ghostscript.
Wordfence reported that the bug is not in WordPress or in the form plugin used for testing. WordPress and the plugin were only the route by which the PDF reached Ghostscript. A form that merely stores an uploaded file without asking for a preview does not start Ghostscript. A form that adds the file to the Media Library can start it when WordPress builds a preview, if the required software and policy settings are in place. Stock WordPress does not let anonymous visitors upload PDFs to the Media Library, so a vulnerable container alone is not enough for an anonymous attack.
The flaw is a heap buffer overflow, a memory error where a program writes more data into a reserved area than that area can hold. Wordfence says the vulnerable path is Ghostscript’s JPEG 2000 decoding path when the OpenJPEG decoder is present. JPEG 2000 images are made of components, such as brightness or transparency, and those components can have different resolutions and use fewer than eight bits per sample. In the minimal public test case described by Wordfence, a row has 1,024 two-bit samples. Ghostscript correctly reserves 256 bytes, but the loop that fills the row writes 1,024 bytes, one byte per sample, instead of packing four samples into each byte.
That overflow writes 768 extra bytes per row beyond the buffer. Wordfence says those bytes come from image samples chosen by the file creator, with constraints from the image format and Ghostscript’s packing loop, and can corrupt memory-management data that Ghostscript later uses. The public test PDF was 1,029 bytes and differed from a harmless control file by one byte in a field describing the transparency component’s resolution. Both files were valid PDFs containing valid JPEG 2000 images, so checking only file extensions, MIME types, or basic file structure would not identify the dangerous case.
Wordfence says it turned the memory corruption into unauthenticated remote code execution on one purpose-built WordPress test deployment. Remote code execution means an attacker can make the server run code. Unauthenticated means no login is needed. The code runs with the permissions of the account processing the PDF, not automatically as the system’s most powerful account. Wordfence also found that Ghostscript’s -dSAFER sandbox, a mode intended to restrict what documents can do through supported features, did not prevent this memory-corruption bug.
The practical risk is serious but not identical for every site. Wordfence built two proof-of-concept exploits for its lab build, then ran them 10,240 times across ten other Linux package environments on 64-bit Intel and AMD systems: Debian, Ubuntu, Fedora, AlmaLinux, Alpine, and the official WordPress container. Neither exploit worked outside the matching build, while both kept working on that build. When Wordfence kept the Ghostscript executable the same but changed fonts, language settings, font configuration and one core system library, the same exploit still succeeded in all four setups, although not on every attempt.
That means this is not a single PDF that automatically compromises every vulnerable server. It also means build-specific exploitation is not harmless. Wordfence pointed to Hacktron’s HEIF Heist research as a relevant warning: Hacktron used AI-assisted exploit development to turn a heap overflow in libheif into code execution against OpenAI’s Discourse forum, and reported code execution or data exposure in other services and products, including Next.js applications. Hacktron reported that adapting an exploit to each new company usually took one or two days, and some attempts required thousands of uploaded images. Wordfence said it has found no public evidence that CVE-2026-39919 is being exploited today.
Affected upstream Ghostscript versions are 9.21 through 10.07.1 where the OpenJPEG decoder path is present. The CVE record states the affected range as before 10.08.0, and Wordfence says the vulnerable sub-byte sampling block was introduced in 9.21. Artifex’s fix in Ghostscript 10.08.0 changes the loop so it counts samples correctly and rejects bit depths that this code path does not support. Administrators should not rely only on `gs --version`, because Linux distributions may backport the fix into older version numbers. Ubuntu 22.04, for example, fixed this in package 9.55.0~dfsg1-0ubuntu5.14, which still reports Ghostscript 9.55.0.
Wordfence tested ten package environments on September 15 and found all vulnerable at that time: the official WordPress Docker image with 10.05.1~dfsg-1+deb13u1, Debian 13 trixie with the same package, Debian 12 bookworm with 10.0.0~dfsg-11+deb12u8, Ubuntu 22.04 LTS with 9.55.0~dfsg1-0ubuntu5.13, Ubuntu 24.04 LTS with 10.02.1~dfsg1-0ubuntu7.8, Ubuntu 26.04 with 10.06.0~dfsg-3ubuntu1, Fedora 44 with 10.06.0-2.fc44, AlmaLinux 10 with 10.02.1-16.el10_0, Alpine 3.22 with 10.05.1-r0, and Alpine 3.23 with 10.06.0-r0. The test PDF crashed Ghostscript on nine of the ten systems. Debian 12 rendered that file without crashing, but 28 of 40 changed image-dimension variants crashed it.
Since those tests, Wordfence says fixed packages have shipped for Ubuntu 22.04, 24.04 and 26.04, Debian 13 through its security repository, and AlmaLinux 10 on October 2. Debian 12 remained listed as vulnerable. As of October 9, official package pages for Fedora 44, Alpine 3.22 and Alpine 3.23 still listed the older revisions from the test table. Containerized sites need special care: Wordfence says the official WordPress Docker image snapshot it tested had Ghostscript 10.05.1, the Imagick extension and a working PDF preview path. Users should pull an updated base image, rebuild without relying on a cached layer, and redeploy.
For site owners, the key question is whether visitors or low-privileged users can upload PDFs that are then converted into previews.