CVE-2026-39919 is a heap buffer overflow in Ghostscript, scored 9.8. A crafted PDF that contains a JPEG 2000 image can corrupt memory in the decoder. On a server that turns untrusted PDFs into thumbnails, that can become code execution.

What happened

Wordfence found the bug on 23 August with its Argus research system and reported it to Artifex. Ghostscript 10.08.0, released 8 September, closes it. Wordfence published the write-up on 12 October, and BleepingComputer covered it on 13 October. Wordfence says it has not seen exploitation in the wild.

The overflow is in the JPEG 2000 output path. A PDF whose image components declare mismatched subsampling, with a sub-byte sample depth, makes the decoder allocate a short row buffer and then write a full byte per column. The write lands past the buffer and can corrupt allocator metadata. It happens even when Ghostscript is started with -dSAFER.

Affected upstream versions are 9.21 through 10.07.1 where the OpenJPEG decoder is present. Wordfence turned the bug into unauthenticated remote code execution on a purpose-built WordPress test server. The same payload was not reliable across ten stock Linux package builds. Success depended on fonts, locale, and one system library. That is a reliability caveat, not a reason to leave the library old.

Who is affected

• Any host running Ghostscript 9.21 through 10.07.1 that renders PDFs it did not create. Web apps, mail gateways, document portals, and preview workers all qualify.
• WordPress sites that generate PDF thumbnails through Imagick and ImageMagick, if Ghostscript is on the PATH and the policy allows PDF rendering. Stock WordPress does not allow anonymous Media Library uploads, so the usual path is a low-privilege account or a plugin that accepts PDFs.
• Shared hosting and container images that bake an old Ghostscript into every site. One base image can expose every tenant.

What to do now

Upgrade Ghostscript to 10.08.0 or a vendor backport, then rebuild any container that still ships 10.07.1 or older. If you cannot upgrade this week, disable PDF rendering in ImageMagick or reject PDF uploads.

Check the package revision, not only the marketing version. Artifex also backported the fix. On WordPress, ask the host which Ghostscript binary the PHP workers actually call. A patched shell on the admin box does nothing if the web container still has the old one.

Code runs as the account that processes the PDF, which is often the web user, not root. That is still enough to read application secrets and pivot. There is no public exploit campaign to point at yet. The preconditions are common enough that waiting for one is the wrong trade.

Source: BleepingComputer, 13 October 2026, Ghostscript flaw lets hackers hijack servers via PDF uploads.