Ghostscript flaw lets hackers hijack servers via PDF uploads

Wordfence researchers used their AI-driven Argus tool to uncover CVE-2026-39919, a critical heap buffer overflow in Ghostscript, the engine behind PDF rendering and thumbnail generation often invoked via PHP's Imagick extension and ImageMagick. By embedding a malformed JPEG 2000 image inside a PDF, attackers can force Ghostscript to write 1,024 bytes into a 256-byte buffer, corrupting memory and potentially achieving unauthenticated remote code execution. The team confirmed the vulnerable code exists across Ghostscript versions 9.21 through 10.07.1, impacting ten tested Linux distributions (Debian, Ubuntu, Fedora, Alpine, AlmaLinux) and the official WordPress Docker image, though real-world exploitation proved inconsistent and depends on factors like PDF fonts, language settings, and system libraries. On WordPress sites specifically, abuse requires PDF upload capability, automatic thumbnail generation, and a Ghostscript-based processing chain — conditions not met by default installs lacking anonymous uploads. Artifex patched the flaw in Ghostscript 10.08.0 on September 8, with backports available for older branches; admins should upgrade via their hosting provider, rebuild Docker images, or temporarily block PDF uploads and disable ImageMagick's PDF rendering if patching isn't immediately possible. Wordfence has not detected any active exploitation of this flaw so far.