A critical heap buffer overflow vulnerability in the Ghostscript interpreter, identified as CVE-2026-39919, could permit remote code execution through specially crafted PDF files, according to a recent report by Bleeping Computer.
Discovered on Aug. 23 by researchers at Defiant's platform Wordfence, the flaw resides in Ghostscript versions 9.21 through 10.07.1. The vulnerability can be exploited when Ghostscript processes a PDF containing a JPEG 2000 image, leading to incorrect handling of low-bit-depth samples and mismatched component resolutions. Researchers developed exploits that force Ghostscript to write excessively into a buffer, corrupting memory and enabling unauthenticated remote code execution in affected systems. While Wordfence focused on WordPress, the vulnerability impacts any system running the affected Ghostscript versions if the payload is adapted. Exploitation in WordPress requires an attacker to upload a PDF, have the site process it for a thumbnail, reach the vulnerable Ghostscript code, and have appropriate software and policy settings. Artifex, the maintainer of Ghostscript, released a fix in version 10.08.0 on September 8, with patches backported to older versions. Administrators are urged to upgrade Ghostscript or, if unable, to block PDF uploads or disable PDF rendering in ImageMagick. No in-the-wild exploitation has been observed yet.
Source: Bleeping Computer
