Ghostscript has a high-severity flaw (CVE-2026-39919) that allows malicious PDF files to run arbitrary code on servers using vulnerable versions of the tool. With a Common Vulnerability Scoring System (CVSS) rating of 9.8/10, the issue impacts Ghostscript releases prior to version 10.08.0. Ghostscript is often used for rendering PDFs, thumbnail generation, and converting PostScript files into images. The vulnerability is particularly dangerous for applications like WordPress, email gateways, document portals, and print or file‐conversion services that accept user‐supplied PDFs.
How the Flaw Works
The problem stems from a heap-based buffer overflow in Ghostscript’s JPEG 2000 image decoder. When processing a PDF that embeds a JPEG 2000 image with unusual component resolution settings and sub-byte sample values, the renderer allocates too little memory and is not equipped to handle the unexpected data volume. That mismatch lets attackers overflow the buffer, corrupt memory, and—on certain server builds—achieve remote code execution without any user authentication.
Researchers demonstrated exploitation in a controlled WordPress environment. The attack chain often runs through WordPress → Imagick → ImageMagick → Ghostscript. Even if WordPress doesn’t directly call Ghostscript, remote execution becomes possible via this processing pipeline whenever previews, thumbnails, or conversions are generated from uploaded PDFs.
Scope, Risk & Mitigation
The flaw affects Ghostscript versions 9.21 through 10.07.1. Version 10.08.0 fixes the issue, though many Linux distributors may have applied patches under older package names or version numbers—meaning checking the binary version alone isn’t sufficient to confirm safety.
Tests across ten different environments—including Debian, Fedora, Ubuntu, AlmaLinux, Alpine, and WordPress’s official Docker image—showed unpatched Ghostscript versions in use as of mid-September. A given malicious PDF exploit won’t necessarily work across all builds, but reuse of a vulnerable Ghostscript binary in multiple environments creates serious potential for widespread compromise.
To protect systems, administrators should update to Ghostscript 10.08.0 or install vendor-backported fixes immediately. For containerized setups, rebuild with updated base images. Managed WordPress users should verify with their hosting providers whether PDF uploads are converted into previews and whether Ghostscript has been patched. In the interim, disable PDF uploads from untrusted users, limit upload size and rate, and adjust ImageMagick policy to block or restrict processing. The ‘-dSAFER’ sandbox mode was tested but still reached the vulnerable path, so it’s not a complete defense.
Beyond Ghostscript: this flaw adds to a growing pattern where image and document converters such as ImageMagick become attack vectors. Recent research has exposed similar risks in HEIC image processing pipelines. The combination of tools handling untrusted media demands continuous vigilance.
What this means: the Ghostscript vulnerability highlights a long-standing yet evolving danger in multimedia processing. As websites and services increasingly outsource preview and conversion work to lower-level libraries, a single flaw deep in the stack can expose large surfaces. Any organization allowing PDF uploads—or using ImageMagick or similar chains—needs to treat this as urgent. Watch for patches, audit your processing pipelines, and don’t assume an older version number means safety.
