567/69 Thursday, October 15, 2026
Researchers from Wordfence disclosed CVE-2026-39919, a Critical vulnerability in Ghostscript with a CVSS v4.0 score of 9.3. Ghostscript is software widely used to process PostScript and PDF files. The vulnerability is a heap-based buffer overflow in the JPEG 2000 image-processing component and affects Ghostscript versions 9.21 through 10.07.1. It could lead to command execution on a server if an application accepts PDF files from users and processes them using an unpatched version of Ghostscript. Researchers developed a Proof-of-Concept (PoC) and successfully achieved command execution in a controlled test environment. Exploitation depends on the target environment, and there is currently no evidence that the vulnerability has been exploited in the wild.
The vulnerability occurs when Ghostscript processes a PDF file containing a JPEG 2000 image with inconsistent component subsampling parameters. This can cause the program to write data beyond the bounds of a buffer, resulting in memory corruption that may lead to command execution. For WordPress websites, the risk arises when users are allowed to submit PDF files and the system generates previews or thumbnails using ImageMagick and an unpatched Ghostscript installation. By default, WordPress does not allow unauthenticated users to upload files through the Media Library, so the attack conditions depend on the website configuration and how Ghostscript is used to process uploaded files.
Administrators should check the installed Ghostscript version and update to version 10.08.0 or to a patched package provided by their operating system vendor, as fixes have also been backported to some earlier Ghostscript releases. Systems running Ghostscript in containers should rebuild and redeploy images using an updated base image. If patching cannot be performed immediately, administrators should restrict or disable PDF uploads from untrusted sources, or temporarily disable PDF processing through ImageMagick and Ghostscript. They should also review which applications on the system send externally supplied files to Ghostscript for processing.