Researchers at Wordfence, a platform owned by Defiant, have disclosed a critical heap buffer overflow vulnerability tracked as CVE-2026-39919 in the Ghostscript PostScript and PDF interpreter. The flaw permits remote code execution when systems process specially crafted PDF files containing JPEG 2000 images with specific encoding properties.

The vulnerability was identified on August 23 using Argus, Wordfence's AI-powered detection system. Ghostscript, widely deployed for rendering PDFs as images, generating preview thumbnails, and optimizing PDF files through image compression and font removal, became a target when WordPress sites leverage the PHP Imagick extension to invoke ImageMagick, which in turn calls Ghostscript for thumbnail generation.

The flaw stems from incorrect handling of low-bit-depth samples and mismatched component resolutions in JPEG 2000 images. Wordfence researchers created two proof-of-concept exploits that force Ghostscript to write 1,024 bytes into a 256-byte buffer, corrupting adjacent memory and enabling unauthenticated remote code execution on vulnerable WordPress installations.

Scope and Testing

The vulnerability affects Ghostscript versions 9.21 through 10.07.1 across any online system running the affected code, not limited to WordPress. Wordfence tested the exploits against ten Linux environments—Debian, Ubuntu, Fedora, Alpine, and AlmaLinux—alongside an official WordPress Docker image snapshot, confirming all contained the vulnerable code.

Testing revealed inconsistent exploitation success. When executing the proof-of-concept exploits 10,240 times against Linux packages in a lab testbed, the researchers failed to achieve remote code execution. However, on a purpose-built test server, code execution succeeded. The researchers determined that modifying the PDF's fonts, language settings, font configuration, and one core system library enabled exploitation, though not reliably.

Tested environments
Tested environmentsSource: Wordfence

WordPress-Specific Requirements

For successful exploitation in WordPress environments, four conditions must be met:

  1. An attacker can upload a PDF, either anonymously or using a low-privileged account
  2. The site processes that PDF to generate a preview or thumbnail
  3. The processing chain reaches Ghostscript with necessary software and policy settings allowing PDF rendering
  4. Ghostscript contains the unpatched vulnerable decoding code

Wordfence noted that default WordPress configuration does not permit anonymous Media Library uploads. However, any application rendering attacker-supplied PDFs through affected Ghostscript code may be vulnerable, with authentication requirements varying by application.

Remediation

Artifex, Ghostscript's maintainer, released version 10.08.0 on September 8 containing the fix. Patches were also backported to earlier versions, so administrators should verify revision details for patch availability.

WordPress administrators should confirm through their hosting provider that Ghostscript has been upgraded to version 10.08.0 or later. For Docker deployments, rebuilding and redeploying with an updated, patched base image is recommended.

Organizations unable to upgrade to a patched Ghostscript release should consider blocking PDF uploads to the server or disabling PDF rendering in ImageMagick as interim mitigations.

Wordfence has not observed any in-the-wild exploitation of CVE-2026-39919 to date.