Ghostscript RCE via crafted PDF patched (CVE-2026-39919)

A heap buffer overflow in Ghostscript lets a crafted PDF trigger remote code execution on any server that renders it through the interpreter. CVE-2026-39919 was discovered by Wordfence's Argus system during a WordPress assessment and fixed in Ghostscript 10.08.0. Wordfence has not observed in-the-wild exploitation, but developed two working proof-of-concept exploits, so the clock is running.

Affected versions

• Product: Ghostscript / GhostPDL (Artifex), and anything that shells out to it — ImageMagick, print pipelines, PDF thumbnailers.
• Affected: releases before 10.08.0. Wordfence lists 9.21 through 10.07.1 as vulnerable.
• Fixed in: 10.08.0, released by Artifex; the fix was backported to older branches, so check your distribution's revision details rather than assuming the package version.

The flaw

The bug lives in the JPEG 2000 output adapter (base/sjpx_openjpeg.c). A crafted PDF carrying a JPEG 2000 image with mismatched component subsampling factors trips incorrect handling of low-bit-depth samples: a row buffer sized for packed output is written one full byte per column, overflowing the allocation and corrupting heap-allocator metadata. Wordfence's PoCs force Ghostscript to write 1,024 bytes into a 256-byte buffer (CWE-122). On a WordPress target, the path is unauthenticated: upload a PDF, WordPress generates a thumbnail via ImageMagick and Ghostscript, and the overflow fires. This is not a WordPress-specific bug — it hits any Ghostscript consumer that processes untrusted PDFs.

Scoring is disputed — patch anyway

The severity rating is not settled, which is worth flagging before you triage by CVSS alone:

• The CVE record scores it 9.8 (CVSS 3.1) and 9.3 (CVSS 4.0) — critical.
• Red Hat's Bugzilla marks it medium.
• Ubuntu's USN-8791-1 rates it important and frames impact as a crash or possible code execution when opening a crafted file.

Exploitability depends on the allocator and build hardening of the target, which is why distributions hedge. Treat the "crafted file reaches an upload pipeline" condition as the real risk indicator, not the headline number.

Action checklist

1. Upgrade Ghostscript to 10.08.0 or your distribution's patched build. On WordPress, that means the host OS or container image, not a plugin update — confirm with your hosting provider.
2. Rebuild and redeploy containers that bundle Ghostscript or ImageMagick off a patched base image; pinned image digests will carry the vulnerable library until you refresh them.
3. If you can't patch immediately, block PDF uploads or disable PDF/JPEG 2000 rendering in ImageMagick's policy.xml for internet-facing upload paths.
4. Inventory where PDFs get rendered — thumbnailers, document converters, mail gateways, CI jobs — not just the obvious web app.

Context

This is the latest reminder that image- and document-processing libraries are a durable RCE surface, reachable wherever an app turns an upload into a preview. WordPress servers keep being the delivery vehicle: in July we covered the wp2shell pre-auth RCE in Core (CVE-2026-63030). Library CVEs like this one age in deployment images long after the upstream fix ships — patch the pipeline, not just the headline product.