Critical Ghostscript flaw could let hackers take over servers via PDF uploads

What is Ghostscript and why does it matter?

Ghostscript is a widely used tool for reading and converting PDF and PostScript files. Many web applications, including WordPress, use it to create image previews or thumbnails from uploaded PDFs. If a server processes user-supplied PDFs with Ghostscript, a flaw in the software could put the whole system at risk.

Details of the vulnerability

Researchers at Defiant (Wordfence) found a critical heap buffer overflow vulnerability in Ghostscript, tracked as CVE-2026-39919. A buffer overflow happens when software writes more data to a memory area than it can hold, which can corrupt memory and allow attackers to run their own code. In this case, the flaw is triggered by a specially crafted PDF file containing a JPEG 2000 image. If the PDF is processed, Ghostscript can be tricked into writing 1,024 bytes into a buffer meant for only 256 bytes, potentially letting an attacker take control of the server.

The vulnerability affects Ghostscript versions 9.21 through 10.07.1. Any application that uses Ghostscript to process PDFs could be at risk, not just WordPress. The researchers tested the flaw on several Linux distributions and found the vulnerable code present in all of them. However, actually exploiting the flaw depends on the server's environment and configuration.

How could an attacker exploit this?

To exploit the flaw on a WordPress site, four conditions must be met:

• The attacker can upload a PDF (either anonymously or with a low-privilege account).
• The site automatically generates a preview or thumbnail of the PDF.
• The processing chain uses Ghostscript to render the PDF.
• The server is running a vulnerable version of Ghostscript.

Stock WordPress does not allow anonymous users to upload files, but some plugins or custom setups might. Other web applications that use Ghostscript for PDF processing could also be exposed, depending on their upload policies.

The researchers developed two proof-of-concept exploits. In lab tests, they could not achieve remote code execution on standard Linux packages, but they did succeed on a test server with specific settings. They found that changing fonts, language settings, and some system libraries could make the exploit work, though not always reliably.

What has been done to fix it?

Artifex, the company behind Ghostscript, released a fix on 8 September 2026 in version 10.08.0. Patches were also backported to older versions, so users should check their software's revision details. Wordfence recommends that WordPress administrators ensure their hosting provider has updated Ghostscript to version 10.08.0 or later. If using Docker, rebuild and redeploy with a patched base image. If upgrading is not possible, block PDF uploads or disable PDF rendering in ImageMagick as a temporary measure.

Is this being exploited in the wild?

As of the latest report, Wordfence said it has not seen any real-world attacks using this vulnerability. However, the details are now public, so the risk of exploitation may increase if systems remain unpatched. The only report so far comes from BleepingComputer, and there is no confirmation yet from the Ghostscript maintainers or security agencies. BleepingComputer↗ (opens in a new tab)

What should you do?

If you run any system that processes user-uploaded PDFs with Ghostscript, check your version and update to 10.08.0 or later. Review your upload policies and consider restricting PDF uploads if you cannot patch immediately. Monitor security advisories for updates from your software vendors.