CVE-2026-39919: RCE via PDF in Ghostscript — the -dSAFER Sandbox…

A heap buffer overflow in Ghostscript's JPEG 2000 decoder enables unauthenticated remote code execution through malicious PDFs. The bug affects all versions from 9.21 to 10.07.1 and was fixed on September 8, 2026 with the release of version 10.08.0. Discovered by Wordfence researchers on August 23 during a WordPress 7.1 security audit, the flaw shows how an innocuous feature like PDF thumbnail generation can open an exploitable path through invisible library chains.

A critical vulnerability in the Ghostscript rendering engine exposes servers that process untrusted PDFs to remote code execution. The flaw, identified as CVE-2026-39919, affects all versions from 9.21 through 10.07.1 and was patched only on September 8, 2026 with the release of version 10.08.0. The discovery, made on August 23 by Wordfence researchers during a WordPress 7.1 security audit, demonstrates how an apparently innocuous function like PDF thumbnail generation can open an exploitable breach through library chains invisible to administrators.

Key Takeaways

CVE-2026-39919 is a heap buffer overflow in Ghostscript's JPEG 2000 decoder (source file base/sjpx_openjpeg.c) with a CVSS 3.1 score of 9.8 out of 10, according to the NVD record and converging technical sources.
Unauthenticated remote code execution is proven in the lab: the WordPress → PHP Imagick → ImageMagick → Ghostscript attack chain reaches the vulnerable path even with the -dSAFER flag enabled.
The Wordfence exploit is build-specific: 10,240 executions across ten Linux environments failed outside the identical Ghostscript binary, but succeeded on four shared setups.
Remediation requires an OS- or container-level update, not an application plugin: Ubuntu 22.04, 24.04, and 26.04, Debian 13, and AlmaLinux 10 have released patches, while Debian 12 remains vulnerable.

The JPEG 2000 Decoder Flaw: Misallocated Row Buffer

The technical core lies in a memory-management error in the base/sjpx_openjpeg.c module, responsible for adapting JPEG 2000 output in Ghostscript. When the decoder processes an image with mismatched component subsampling factors, the non-samescale sub-byte-depth path allocates a row buffer for packed output but writes a full byte per column. This discrepancy triggers a 1,024-byte overflow in a 256-byte buffer, according to technical data released by Wordfence via BleepingComputer.

The overflow corrupts the chunk allocator's metadata, enabling controlled memory manipulation and arbitrary code execution. The NVD record explicitly describes the vulnerability as a "heap-based buffer overflow" in the "JPEG 2000 output adapter," confirming the location and nature of the flaw. Artifex, the Ghostscript maintainer, received the report on August 24, 2026 and released the patch on September 8.

The WordPress Attack Chain: Unauthenticated PDF Upload

The documented attack vector exploits a common library chain in web hosting. A malicious PDF uploaded to a WordPress instance with the PHP Imagick extension active triggers ImageMagick, which in turn invokes Ghostscript for thumbnail generation. This mechanism, standard in many shared-hosting configurations, makes Ghostscript an invisible dependency: most administrators are unaware of its presence and do not monitor its security updates.

The attack condition requires the ability to upload PDFs, which stock WordPress does not allow anonymously but becomes feasible through form plugins, user areas, or custom upload functionality. The source does not document the existence of in-the-wild exploits at the time of publication: Wordfence stated it had not detected active use of the flaw during its observation period.

The -dSAFER Sandbox Failure and Build Specificity

A technically significant aspect is the ineffectiveness of the -dSAFER flag, traditionally considered a standard mitigation in shared Ghostscript environments. According to CyberSecurityNews, reporting Wordfence's test results, researchers reached the vulnerable path with the sandbox enabled. The source explicitly quotes: "Do not treat -dSAFER as a fix." This finding removes a long-standing line of defense and mandates a direct binary-level fix.

Exploitability, however, carries a significant limitation: it is build-specific. Wordfence ran 10,240 attempts across ten different Linux environments without success outside the matching build, but verified repeated success on four setups sharing the exact same Ghostscript binary. As SecurityOnline.info reports, citing Wordfence: "Build-specific exploitation is harder, not harmless." This specificity does not negate the risk, especially in shared-hosting or container environments where standardized images replicate identical Ghostscript builds across thousands of instances.

"Build-specific exploitation is harder, not harmless" — Wordfence

Remediation

The fix requires updating the Ghostscript package at the OS or container-image level, not installing a WordPress plugin. Linux distributions have adopted staggered timelines: Ubuntu 22.04, 24.04, and 26.04 are patched; Debian 13 is patched while Debian 12 remains vulnerable; AlmaLinux 10 received the update on October 2, 2026. Infrastructure operators must verify the Ghostscript version actually running, regardless of the base OS update status.

For WordPress environments, risk assessment must include mapping PDF upload capabilities and the presence of the Imagick/ImageMagick/Ghostscript chain. The source documents no alternative corrective measures to patching the binary: replacing or disabling Ghostscript where not strictly necessary is an option only evaluable in the context of the specific architecture, not generically recommended by the dossier. Awareness of the dependency chain that turns a PDF into executable code is the prerequisite for proper risk prioritization.

The Lesson of the Invisible Supply Chain

CVE-2026-39919 illustrates a systemic risk pattern: OS components, often outside the purview of application developers, become compromise vectors through indirect invocation chains. The PDF, an apparently passive document format, reveals itself as an active container of executable payload when it meets a flawed decode stack. Build specificity offers partial risk attenuation, but no guarantee: the homogeneity of container images and shared hosting turns exploit "difficulty" into relevant probability at scale.

The temporal gap between discovery (August 23), upstream fix (September 8), and availability in distribution repositories (with documented variances between October and dates still undefined for Debian 12) highlights the window gap problem in system-dependency management. Risk management can no longer stop at the recognized application perimeter.

Frequently Asked Questions

Is stock WordPress vulnerable without additional plugins?: No. A base WordPress installation does not allow anonymous PDF upload. The documented attack chain requires a configuration that extends upload capabilities, through form plugins, user areas, or custom functionality.
Why doesn't the CVSS 9.8 score translate to a universal exploit?: The CVSS score describes the theoretical worst case per the 3.1 metric, not the actual probability of success. As Wordfence notes, cited by SecurityOnline.info: "You should patch it, but the score describes a worst case rather than a guarantee." Build specificity limits exploit portability but does not eliminate risk for identical configurations.
What is the difference between the Artifex patch and the Linux distribution patches?: Artifex released Ghostscript 10.08.0 on September 8, 2026. Individual distributions must adopt and ship the package in their own repositories: timelines vary, as documented for Ubuntu (patched), Debian 13 (patched), Debian 12 (still vulnerable), and AlmaLinux 10 (patched October 2, 2026).

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter