Ghostscript critical flaw CVE-2026-39919: RCE from PDF upload on WordPress

Wordfence Threat Intelligence, through its Argus system, has discovered a critical vulnerability in Ghostscript, the utility that many servers use to convert uploaded PDFs into JPEG previews. The flaw is tracked as CVE-2026-39919. It affects anyone managing a site that accepts PDF uploads, WordPress included: if a visitor can upload a file, the server could execute arbitrary code without requiring any credentials.

What's in the PDF that breaks Ghostscript

A deliberately crafted PDF containing a JPEG 2000 image that declares inconsistent subsampling factors across components triggers a buffer overflow in base/sjpx_openjpeg.c, Ghostscript's JPEG 2000 output adapter. The defect lies in the code Ghostscript uses to decode JPEG 2000 images within PDFs: a specially constructed file can cause Ghostscript to write data beyond the end of a memory buffer, and this corruption can lead to code execution with the permissions of the account processing the file. Wordfence escalated this corruption to unauthenticated remote code execution on a purpose-built WordPress test site.

The file is indistinguishable from a normal PDF with standard checks: file extension, MIME type and basic structure validation will not catch it. And relying on Ghostscript's sandboxing is insufficient: Ghostscript's -dSAFER sandbox does not stop it.

Scoring and patch

The CVE record assigns a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3. Artifex released Ghostscript 10.08.0 on 8 September 2026, fixing a critical heap buffer overflow with a CVSS score of 9.8, sixteen days after Wordfence's report. Ghostscript's official CVE page confirms that the same version 10.08.0 also closes CVE-2026-19547.

Debian users will find the fix in advisory DSA-6516-1, published on 25 September 2026.

What site administrators need to do

Wordfence escalated the flaw to unauthenticated remote code execution on a WordPress test site: site administrators must update the system package, as there is no WordPress plugin update available. PDF preview generation is a WordPress core feature since version 4.7 and is provided through WP_Image_Editor_Imagick, which requires Imagick, ImageMagick and Ghostscript support: this therefore affects any installation accepting PDF uploads to the media library, not just sites with dedicated plugins.

Verify the installed version with gs --version and update to 10.08.0 or later remains the only definitive fix. Where immediate patching is not feasible, disabling JPEG 2000 image processing or isolating the Ghostscript process reduces exposure, but does not eliminate the risk.