A single PDF upload can be enough to run code on a web server, if that server turns the file into a thumbnail with an unpatched copy of Ghostscript. Researchers at Wordfence found the flaw, tracked as CVE-2026-39919, and turned it into unauthenticated remote code execution on a purpose-built WordPress test site. Artifex fixed it in Ghostscript 10.08.0 on September 8, 2026, but many Linux distributions were still catching up as of October 9.
The bug carries a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3. It was found by Wordfence Argus, the company's AI-assisted testing system, during a WordPress 7.1 security assessment led and validated by Alex Thomas, according to the original report. Wordfence reported it sixteen days before the fix shipped, and Artifex confirmed it the next day.
The flaw sits several layers below WordPress
Ghostscript is a document engine that reads PDF and PostScript files and renders their pages as images. Applications rarely mention it by name. In WordPress, a PDF preview passes from WordPress to the PHP Imagick extension, then to ImageMagick, which launches Ghostscript. Wordfence stresses that this is not a WordPress bug: any application that hands untrusted PDFs to an affected build may be exposed, including document management systems, print services, invoice processors, mail gateways and conversion APIs.
The flaw is a heap buffer overflow, meaning the program writes more data into a block of memory than it reserved. It lives in Ghostscript's JPEG 2000 decoding path when the OpenJPEG decoder is present, in versions 9.21 through 10.07.1. In Wordfence's minimal test case, Ghostscript correctly reserves 256 bytes for a row of 1,024 two-bit samples, then writes one full byte per sample, spilling 768 attacker-influenced bytes into memory it uses for bookkeeping. The write happens even with Ghostscript's -dSAFER sandbox enabled.
Hard to aim, but not hard enough to ignore
Wordfence's two working exploits were tied to the exact build they were made for. Run 10,240 times across ten other Linux package environments, including Debian, Ubuntu, Fedora, AlmaLinux, Alpine and the official WordPress Docker image, neither succeeded once. On the matching executable, though, the exploit still worked after the team changed fonts, language settings and a core system library. The researchers say that points to risk for targeted attacks and for fleets of servers built from one shared image. They found no public evidence of exploitation.
All ten environments Wordfence tested on September 15 were vulnerable, including the official WordPress Docker image snapshot. Stock WordPress does not let anonymous visitors upload PDFs to the Media Library, so an attacker would also need a plugin, form or account that provides that path. WordPress itself has had a busy month, with a core flaw patched in 7.1.2.
Check the package revision, not gs --version
Distributions often backport fixes into older version numbers. Ubuntu 22.04's fixed package, 9.55.0~dfsg1-0ubuntu5.14, still reports Ghostscript 9.55.0. Use dpkg -s ghostscript on Debian and Ubuntu or rpm -q ghostscript on Fedora and the Red Hat family, and compare against your vendor's advisory. Per Wordfence, Ubuntu has fixed 22.04, 24.04 and 26.04, Debian 13 is fixed through its security repository while Debian 12 remains listed as vulnerable, and AlmaLinux 10 shipped a fix on October 2. As of October 9, Fedora 44 and Alpine 3.22 and 3.23 still listed older revisions. Containers must be rebuilt from an updated base image, not just restarted. The 10.08.0 release candidate is not fixed.
If you cannot patch yet, stop accepting PDFs from anonymous or low-privileged users, or disable PDF reads in ImageMagick's security policy. Rate limiting uploads reduces attempts but does not close the hole. Wordfence's broader point is that the dangerous code is often software nobody chose on purpose, reached by something as ordinary as a document upload.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.