Critical Ghostscript security flaw Lets Malicious PDFs Trigger code to be run remotely

What happened

Artifex released Ghostscript 10.08.0 on September 8, 2026, to address the issue after Wordfence Threat Intelligence discovered and privately reported it during a WordPress (content management system) 7.1 security assessment. A critical vulnerability in Ghostscript could allow attackers to execute code on vulnerable servers by uploading a specially crafted PDF containing a malicious JPEG 2000 image.

Tracked as CVE-2026-39919, the vulnerability is a heap-based buffer overflow rated 9.8 out of 10 under CVSS v3.1 and 9.3 under CVSS v4.0, reflecting a worst-case unauthenticated, network-reachable remote […] The post Critical Ghostscript Vulnerability Lets Malicious PDFs Trigger Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform . cyber security Cyber Security News Vulnerability 3 min.

Read Critical Ghostscript Vulnerability Lets Malicious PDFs Trigger Remote Code Execution By Mayura Kathir October 13, 2026 Share Facebook Twitter Pinterest WhatsApp A critical vulnerability in Ghostscript could allow attackers to execute code on vulnerable servers by uploading a specially crafted PDF containing a malicious JPEG 2000 image. Tracked as CVE-2026-39919, the vulnerability is a heap-based buffer overflow rated 9.8 out of 10 under CVSS v3.1 and 9.3 under CVSS v4.0, reflecting a worst-case unauthenticated, network-reachable remote code execution (running programs on a machine from somewhere else) scenario. The vulnerability affects Ghostscript versions before 10.08.0 and resides in the JPEG 2000 output adapter, specifically the code handling images whose components use mismatched subsampling factors.

Key facts

• Artifex — released: Ghostscript 10.08.0 on September 8, 2026, to address the issue after Wordfence Threat Intelligence discovered and privately reported it during a WordPress 7.1 security assessment