Ghostscript 9.21-10.07.1 – Unauthenticated RCE Risk via WordPress PDF Previews (CVE-2026-39919)

CVE-2026-39919 is a critical heap buffer overflow in Ghostscript’s JPEG 2000 decoder. On WordPress servers that generate previews from user-supplied PDFs, a crafted document can reach Ghostscript through Imagick and ImageMagick. Wordfence demonstrated unauthenticated remote code execution on a purpose-built WordPress deployment, although the working exploit was specific to the tested Ghostscript build.

Affected versions and severity

• Component: Artifex Ghostscript
• Affected upstream versions: 9.21 through 10.07.1 when the OpenJPEG decoder path is present
• Fixed upstream version: 10.08.0 final release
• CVE: CVE-2026-39919
• Severity: Critical, CVSS 3.1 score 9.8 and CVSS 4.0 score 9.3
• Privileges required: None when a public or low-privileged upload path processes PDFs
• Attack class: Heap-based buffer overflow leading to memory corruption and possible remote code execution

When a WordPress site is exposed

This is not a flaw in WordPress core or an upload plugin. The vulnerable chain is WordPress to Imagick to ImageMagick to Ghostscript. A site is exposed only when all of the following are true:

1. A visitor or low-privileged user can upload a PDF.
2. WordPress or another application generates a preview, thumbnail, or image from that PDF.
3. The server uses Imagick, ImageMagick, or another tool that invokes Ghostscript.
4. The installed Ghostscript package does not contain the vendor fix.

Stock WordPress does not allow anonymous Media Library uploads, but public forms, document portals, membership features, and custom upload routes can provide the missing upload path. Wordfence also found the required processing chain in the official WordPress Docker image snapshot it tested.

How the vulnerability works

The flaw is in Ghostscript’s JPEG 2000 output adapter. A specially structured JPEG 2000 image embedded in a PDF can make the decoder reserve a packed row buffer and then write a full byte for each sub-byte sample. The resulting out-of-bounds writes corrupt heap metadata. Wordfence converted the corruption into code execution on one matching build while Ghostscript’s -dSAFER mode was enabled.

The exploitability is build-dependent. Wordfence’s two proof-of-concept files did not work unchanged across ten other Linux package environments, but the matched exploit continued to work on systems using the same Ghostscript executable. That limits portability, not impact.

Immediate remediation

1. Install the fixed Ghostscript package supplied by your operating system or hosting provider.
2. Do not rely on gs --version alone. Linux distributions may backport the fix while retaining an older upstream version number, so verify the full package revision against the distribution advisory.
3. Follow the vendor or host’s restart guidance after updating.
4. Rebuild and redeploy containerized WordPress sites from an updated base image without reusing a cached vulnerable layer.
5. If you cannot patch immediately, stop accepting PDFs from visitors and low-privileged users, or disable PDF reads in ImageMagick’s security policy. This also disables PDF previews.
6. Purge application, object, and CDN caches after deployment, then retest legitimate PDF handling.

Verify the installed package

Use the package manager that owns Ghostscript on the server:

gs --version
dpkg-query -W -f='${Package} ${Version}\n' ghostscript
rpm -q ghostscript

Run only the command appropriate for the operating system. Compare the full package revision with the current advisory from the distribution. For managed hosting, ask the provider to confirm that its Ghostscript package includes the fix for CVE-2026-39919 and that customer PDFs cannot reach an unpatched converter.

WordPress verification

• Open Tools > Site Health > Info > Media Handling and check whether Imagick recognizes PDF. This is a starting point, not proof of exposure or patch status.
• Inventory public forms, frontend uploaders, membership features, and document workflows that accept PDFs.
• Confirm whether each workflow stores the file only or also creates a preview or thumbnail.
• After patching, upload a harmless PDF through every legitimate workflow and confirm previews still work as expected.

Indicators and log review

• Repeated anonymous or low-privileged PDF uploads, especially bursts aimed at preview-generating forms.
• Ghostscript crashes, segmentation faults, worker restarts, or image-processing errors following PDF uploads.
• Unexpected files, processes, outbound connections, scheduled tasks, or administrator accounts created after a suspicious upload.
• Multiple conversion attempts for one uploaded PDF. WordPress may retry failed PDF preview generation with a different setting.

Exploitation status

Wordfence demonstrated code execution in a lab but reported no public evidence of exploitation in the wild as of its October 12 advisory. CVE-2026-39919 was not found in the CISA Known Exploited Vulnerabilities catalog during this review. Because successful exploitation can run code as the document-processing account, affected upload workflows should still be patched urgently.

Sources

• Wordfence technical advisory
• Artifex Ghostscript 10.08.0 release
• Artifex fix commit
• CVE record for CVE-2026-39919
• Debian package status

This advisory is based on research and disclosures from Wordfence, Artifex, the CVE Program, and operating-system vendors. WPDeeply did not discover this vulnerability.