Critical Ghostscript vulnerability allows remote code execution through malicious PDF files
A heap buffer overflow flaw in the Ghostscript engine allows attackers to execute remote code on systems processing altered PDF uploads.
FTMQ Security, written by our newsroom0 views
A critical heap buffer overflow vulnerability in the Ghostscript interpreter and rendering engine allows remote code execution through specially crafted PDF files, BleepingComputer and Cyber Press reported. The security flaw is tracked as CVE-2026-39919. Cyber Press noted that the vulnerability can enable unauthenticated remote code execution specifically through PDF uploads on WordPress sites. [1][2]
Security researchers at Wordfence discovered the vulnerability on August 23 using an artificial intelligence system called Argus, according to BleepingComputer. Ghostscript processes PDF files by rendering them as images, generating preview thumbnails, and optimizing documents by compressing embedded images and removing unnecessary font data. [1]
Ghostscript is a software suite based on an interpreter for PostScript and Portable Document Format page description languages. It rasterizes documents, displays or prints pages, and converts files between PostScript and PDF formats. [3]
Dr. L. Peter Deutsch originally developed Ghostscript in 1988 as an open-source PostScript interpreter. Artifex Software, Inc. was founded in 1993 to manage its commercial licensing and development, releasing version 10.06.0 in September 2025. Ghostscript supports formats including PostScript, PDF, PCL, and XPS. [4]
In short
- CVE-2026-39919 is a critical heap buffer overflow vulnerability in Ghostscript.
- The flaw allows remote code execution through specially crafted PDF uploads.
- Wordfence researchers identified the issue on August 23 using their Argus AI platform.
- Ghostscript was created by Dr. L. Peter Deutsch in 1988 and is managed by Artifex Software.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Ghostscript flaw lets hackers hijack servers via PDF uploadsBleepingComputer, 4h ago (the report this story comes from)
- [2]Critical Ghostscript Flaw Can Enable Unauthenticated RCE Through WordPress PDF UploadsCyber Press, 15h ago
Background
- [3]Ghostscript on Wikipedia
- [4]Ghostscript on Grokipedia
Our newsroom writes these reports with the help of software, from the 4 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- CISA warns of privilege escalation vulnerability in Inductive Automation IgnitionThreat Intelligence, 1h ago
- Hackers target Rejetto HFS servers following critical session forgery vulnerability discoveryTop Stories, 8d ago
- Proof of concept exploit released for critical VMware VMXNET3 security flawBugs and Patches, 5d ago
- High severity NVIDIA DCGM Exporter vulnerability threatens internet exposed GPU serversCybercrime and Scams, 4d ago
More in Top Stories
- Meta suffers GitHub breach exposing corporate code and employee data1h ago
- Former OpenAI engineer arrested after covert listening device found in conference room1h ago
- Microsoft releases updates for more than 1400 security vulnerabilities1h ago
- IonQ acquires zero trust firm Elisity in transaction worth up to 1.3 billion1d ago
- Drone attacks damage Yandex data centers causing cloud service outages1d ago
- Ahold Delhaize takes systems offline following cybersecurity incident1d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.