Critical Ghostscript CVE-2023-38545 Flaw Lets Attackers Execute Code via Malicious PDFs

Key Takeaways

• A critical vulnerability, CVE-2026-39919, has been discovered in Ghostscript, a widely used PDF rendering engine.
• The flaw could enable unauthenticated remote code execution on servers processing specially crafted PDF files.
• Impacted systems include WordPress sites, document portals, and any service that uses Ghostscript to handle user-uploaded PDFs.
• The vulnerability affects Ghostscript versions before 10.08.0 and carries a CVSS score of 9.8.
• A patch is available in Ghostscript 10.08.0; immediate updates are strongly recommended.

Critical Ghostscript Flaw Exposes Servers to Remote Code Execution

A severe security vulnerability in Ghostscript, a core component for processing PDF and PostScript files, could allow attackers to execute arbitrary code on affected servers. The flaw, identified as CVE-2026-39919, carries a critical CVSS score of 9.8, indicating its high potential for exploitation.

Ghostscript is an ubiquitous tool, often operating silently in the background of various services to render PDFs, generate document thumbnails, and convert file formats. This makes the vulnerability particularly concerning for platforms that accept user-uploaded PDF files, such as content management systems like WordPress, document management portals, print services, email gateways, and file conversion APIs.

The danger stems from the fact that even if an application itself doesn’t directly interact with Ghostscript code, it may call upon Ghostscript as a lower-level dependency to process user-supplied files. A maliciously crafted PDF could therefore trigger the vulnerability without the primary application ever directly handling the exploit payload.

Discovery and Technical Details

Researchers from Wordfence identified the vulnerability during a security assessment of WordPress 7.1, leveraging their Argus testing system. The flaw is categorized as a heap-based buffer overflow, specifically occurring within Ghostscript’s JPEG 2000 image decoding path.

The vulnerability manifests when Ghostscript processes a PDF that contains a JPEG 2000 image with unusual component resolution settings and sub-byte sample values. Essentially, the program allocates insufficient memory for the image data and subsequently attempts to write more data than the buffer can accommodate. This overflow corrupts adjacent memory, which, as Wordfence researchers demonstrated in a controlled WordPress environment, can be exploited to achieve remote code execution.

The resulting code would execute with the privileges of the account processing the PDF (e.g., a web server or PHP-FPM user), rather than automatically gaining root access. The NVD vulnerability record confirms the heap-based buffer overflow and its potential for memory corruption through crafted JPEG 2000 content within a PDF.

The risk chain often begins when an application accepts a PDF and attempts to generate a preview or thumbnail. In many WordPress configurations, this involves a sequence where WordPress passes the file to Imagick, which then uses ImageMagick, which in turn calls Ghostscript. The memory bug itself resides within Ghostscript, distinguishing this issue from earlier WordPress Imagick flaws where upload validation could be bypassed.

Affected Versions and Real-World Implications

The vulnerable code was introduced in Ghostscript version 9.21 and impacts all upstream versions up to 10.07.1. Artifex, the vendor, addressed the vulnerability in Ghostscript 10.08.0. The official Ghostscript CVE page confirms that CVE-2026-39919 was patched in this release.

However, simply checking gs --version might not definitively confirm safety, as Linux distributions often backport fixes to older-looking package versions. Wordfence conducted tests across ten package environments, including Debian, Ubuntu, Fedora, AlmaLinux, Alpine Linux, and an official WordPress Docker image, finding vulnerable builds in many of these environments as of September 15.

While the researchers’ proof-of-concept files did not work universally across all systems, build-specific exploits proved effective on systems sharing the same Ghostscript executable. This implies that a threat actor may not need a single, all-encompassing PDF exploit if their targets utilize similar vulnerable builds, a concern particularly relevant for hosting providers and organizations deploying numerous servers from a consistent container image.

This incident underscores a broader trend, mirroring recent research on malicious HEIC images, which highlighted how native media-processing libraries can expose WordPress servers when uploaded files reach vulnerable decoders.

What You Should Do

• Update Immediately: Install the patched Ghostscript package provided by your operating system vendor or hosting provider. For containerized environments, rebuild images from an updated base image and redeploy them.
• Verify Patches: Do not rely solely on version numbers (e.g., gs --version), as Linux vendors may backport fixes. Confirm with your vendor that the specific CVE-2026-39919 fix has been applied.
• Restrict PDF Uploads: If immediate updates are not feasible, consider temporarily disabling PDF uploads from untrusted users or configuring ImageMagick policy settings to block PDF processing.
• Disable PDF Previews: Managed WordPress users should inquire with their hosting provider about whether their Ghostscript package is patched and if uploaded PDFs are converted into previews, which could trigger the vulnerability.
• Review File Processing Chains: Organizations should conduct a thorough review of their document and image conversion services, as Ghostscript and ImageMagick can be part of wider, complex file-processing risk paths.
• Do Not Rely on -dSAFER: Ghostscript’s -dSAFER mode should not be considered a mitigation, as Wordfence researchers were able to reach the vulnerable code path even with this sandbox setting enabled.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.