Ghostscript bug can let crafted PDFs trigger remote code execution

Artifex has patched the flaw, but operators still need to check what version is actually running.

Wordfence says a critical Ghostscript heap buffer overflow, CVE-2026-39919, can let attackers reach remote code execution by feeding crafted PDFs into systems that invoke Ghostscript. The issue affects Ghostscript 9.21 through 10.07.1, and the researchers reported that their exploit work succeeded on a purpose-built test server but not reliably. Artifex shipped a fix in Ghostscript 10.08.0 on September 8, with backports available for older lines, so operators need to verify patch status rather than assume the latest revision is installed. For WordPress setups, the risky path requires PDF upload, thumbnail generation, a processing chain that reaches Ghostscript, and an unpatched vulnerable decoder, while stock WordPress does not allow anonymous Media Library uploads. Wordfence says it has not seen active exploitation in the wild yet.