A critical Ghostscript vulnerability can allow attackers to execute code on servers that automatically process malicious PDF files, potentially placing WordPress websites, document-management systems and other PDF-rendering services at risk.
Tracked as CVE-2026-39919, the heap buffer overflow affects Ghostscript versions 9.21 through 10.07.1. Artifex corrected the vulnerability in Ghostscript 10.08.0 and backported fixes to some older release branches.
Wordfence researchers demonstrated remote code execution in a controlled WordPress environment. They have not observed exploitation in real-world attacks.
MALICIOUS PDF TRIGGERS MEMORY CORRUPTION
Ghostscript is a widely deployed PostScript and PDF interpreter. Web applications and server-side tools use it to render documents, create previews, generate thumbnails and optimize uploaded PDF files.
CVE-2026-39919 involves Ghostscript’s handling of JPEG 2000 images containing low-bit-depth samples and components with mismatched resolutions.
Researchers developed malicious PDFs that caused Ghostscript to write 1,024 bytes into a buffer allocated for only 256 bytes. The resulting memory corruption may allow an attacker to alter program execution and run code with the permissions assigned to the document-processing service.
In a WordPress configuration, an uploaded PDF may travel through Imagick and ImageMagick before Ghostscript generates a preview image. Exploitation occurs on the server during that automated processing, before an administrator needs to open the document.
REMOTE CODE EXECUTION REQUIRES SPECIFIC CONDITIONS
Successful exploitation is not automatic on every server running a vulnerable Ghostscript version. Wordfence identified four primary requirements in WordPress environments:
- An attacker must be able to upload a PDF anonymously or through a low-privileged account.
- The application must automatically process the PDF to create a preview or thumbnail.
- The processing chain must invoke Ghostscript.
- The installed Ghostscript build must contain the vulnerable decoding code.
A default WordPress installation does not allow anonymous Media Library uploads. However, form plugins, membership platforms, customer portals, recruitment systems and document-submission tools may provide unauthenticated or low-privileged upload functions.
The same underlying risk applies outside WordPress. Any public-facing service that sends attacker-controlled PDFs to a vulnerable Ghostscript installation may expose the affected code path.