Researchers at Defiant’s Wordfence, using their Argus AI–powered platform, disclosed on August 23 that the Ghostscript PostScript and PDF interpreter contains a severe vulnerability. The flaw arises when Ghostscript decodes a PDF containing a JPEG 2000 image with low-bit-depth samples and mismatched component resolutions, causing incorrect handling that can overflow a buffer and corrupt nearby memory.
How the bug operates in Ghostscript
Wordfence reported that the vulnerability (CVE-2026-39919) occurs in Ghostscript releases from 9.21 through 10.07.1. The two proof-of-concept exploits the researchers developed force Ghostscript to write 1,024 bytes into a 256-byte buffer, producing memory corruption that can be escalated to unauthenticated remote code execution when the payload is adapted to the target environment.
Wordfence testing: broad exposure, inconsistent exploitation
To measure exposure, Wordfence tested ten Linux environments — including Debian, Ubuntu, Fedora, Alpine, and AlmaLinux — plus an official WordPress Docker image snapshot, and found the vulnerable code present in all of them. The team executed their exploits 10,240 times against various Linux packages in a lab testbed without achieving remote code execution, but they did successfully run code on a purpose-built test server.
Successful exploitation depended on environmental factors. Wordfence noted that changes to the PDF’s fonts, language settings, font configuration, and one core system library could enable the exploit to succeed, though not reliably. Their work shows the bug is widely present but that exploitation requires tuning to the target stack.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhy WordPress sites are specifically at risk
Wordfence focused on WordPress because a common thumbnail workflow can reach Ghostscript: when WordPress generates a PDF thumbnail it may use the PHP Imagick extension to invoke ImageMagick, which in turn launches Ghostscript. In WordPress deployments the researchers identified four prerequisites for a successful exploit:
- An attacker can upload a PDF (either anonymously or via a low‑privileged account).
- The site processes that PDF to create a preview or thumbnail.
- The processing chain reaches Ghostscript, with the necessary software and policy settings allowing PDF rendering.
- Ghostscript contains the unpatched vulnerable decoding code.
Wordfence also noted that stock WordPress does not permit anonymous uploads to the Media Library, underlining that whether an attacker can supply a PDF depends on the specific site configuration or plugins.
Patch, mitigations, and operational advice
Artifex, Ghostscript’s maintainer, issued a fix on September 8 in Ghostscript version 10.08.0 and also backported fixes to older versions; administrators are advised to check revision details to confirm patch status. Wordfence recommended that WordPress administrators verify, through their hosting provider, that Ghostscript has been upgraded to 10.08.0 or later. For Docker users, the guidance is to rebuild and redeploy using a patched base image.
Where immediate upgrading is not possible, Wordfence suggested two compensating controls: block PDF uploads to the server or disable PDF rendering in ImageMagick, which would prevent Ghostscript from being invoked in the thumbnail/preview path.
What this means for WordPress administrators, hosting providers, and Docker operators
- WordPress administrators: Confirm whether your site’s thumbnail generation uses Imagick/ImageMagick and whether Ghostscript is present on hosted systems; if you cannot confirm a patched Ghostscript, block PDF uploads or disable PDF rendering.
- Hosting providers: Validate Ghostscript versions across managed images and shared hosts, deploy Ghostscript 10.08.0 or later, and rebuild any official VM or container images so tenants inherit patched software.
- Docker and container operators: Rebuild and redeploy containers from updated base images that include Ghostscript 10.08.0+ to eliminate vulnerable interpreter binaries from running containers.
Wordfence said it has not observed in‑the‑wild exploitation of CVE-2026-39919 to date, but the combination of wide code presence and the ability to craft payloads that trigger a classic heap overflow means defenders should treat systems that render attacker-supplied PDFs as high priority for patching or mitigation. The immediate next step for affected operators is simple and verifiable: ensure Ghostscript is 10.08.0 or later, or put in place controls that prevent attacker-supplied PDFs from reaching Ghostscript.
