+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityCVEHosting

CVE-2026-39919: Ghostscript Turns a PDF Thumbnail Into Unauth RCE - Floor Is the Package Revision, Not gs --version

By ServerGurus Team15 October 20268 min read
CVE-2026-39919: Ghostscript Turns a PDF Thumbnail Into Unauth RCE - Floor Is the Package Revision, Not gs --version

The Situation

There is no WordPress plugin to update. CVE-2026-39919 is a heap buffer overflow in Artifex Ghostscript (base/sjpx_openjpeg.c). WordPress 4.7+ PDF previews reach it through Imagick → ImageMagick → gs. The process runs as the web user. -dSAFER does not stop it.[1][2][3]

CNA is VulnCheck. Title: Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter. CWE-122. Finders on the CVE record: Alex Thomas, Wordfence and Wordfence Argus. CVSS 3.1 9.8 CRITICAL AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CVSS 4.0 9.3. datePublic 2026-09-08. datePublished 2026-09-15T14:26:06.697Z.[2][3]

NVD vulnStatus Awaiting Analysis, lastModified 2026-09-24T21:04:40.340. NVD has not issued its own CVSS; the 9.8/9.3 numbers on that page are Secondary from VulnCheck.[4]

Wordfence published the operator write-up on 12 October 2026. They reduced it to a 1,029-byte PDF, confirmed the overflow on 10.07.1 and 10.08.0rc1, and demonstrated unauthenticated remote code execution on one purpose-built WordPress lab. They say they have no public evidence it is being exploited today. We did not reproduce that lab.[1]

CISA KEV catalog version 2026.10.14 (count 1745, dateReleased 2026-10-14T19:27:28.0105Z) does not list CVE-2026-39919. Newest dateAdded 2026-10-14 is Ahsay CBS, Cisco Secure Email Gateway, and PAN-OS - not Ghostscript. Do not wait for a BOD due date.[10]

gs --version is not the floor. Distros backport. Ubuntu 22.04's fixed package still prints 9.55.0. The 10.08.0 release candidate also prints 10.08.0 and Wordfence says it is not fixed. Read the full package revision.[1][5][6]

What the bug actually is

CVE.org, verbatim: Ghostscript before 10.08.0 overflows a heap buffer in the JPEG 2000 output adapter when a crafted PDF contains a JPEG 2000 image with mismatched component subsampling. The non-samescale sub-byte-depth path allocates a packed row then writes a full byte per column, corrupting chunk-allocator metadata.[2][3]

Wordfence's public geometry (their numbers, not ours): a row of 1,024 two-bit samples needs 256 packed bytes; the fill loop writes 1,024 bytes. The 1,029-byte test file differs from a harmless control by one byte in a transparency-component resolution field. Extension / MIME / "is this a PDF" checks do not see it. We are not publishing that file.[1]

Affected code, per Wordfence source history: Ghostscript 9.21 through 10.07.1 when the OpenJPEG decoder path is present. CVE product status is simpler: affected from 0 before 10.08.0. Use the distro revision, not that range, to decide if you are patched.[1][2]

Artifex shipped Ghostscript/GhostPDL 10.08.0 on 2026-09-08T12:29:24Z (gs10080). CVE.org's patch URL is commit 0a8bf88e39db07b0751a58d6ec1cf992073e4dc1.[8][9] Debian's tracker also points at Bugzilla 709666 and a different cgit id (8ddaa67…, tagged ghostpdl-10.08.0). We did not diff those two commits.[7][15]

Wordfence: this is not a WordPress bug. Any app that hands untrusted PDFs to an affected gs is in scope - DMS, print, invoice, mail gateway, conversion API. Searching application source for the string Ghostscript will miss ImageMagick sitting in the middle.[1]

Wordfence's RCE claim - their lab, not the Internet

They built two working PoCs for one Ghostscript build, then ran them 10,240 times across ten other 64-bit package environments (Debian, Ubuntu, Fedora, AlmaLinux, Alpine, official wordpress Docker). Neither succeeded once off the matching executable. Keep the same gs binary, change fonts / locale / one libc: the matched exploit still worked in all four of those setups, not on every attempt.[1]

Their Sept 15 snapshot of the official wordpress image shipped 10.05.1~dfsg-1+deb13u1 plus Imagick and a working PDF preview path - vulnerable in that snapshot. Stock WordPress still does not let anonymous visitors upload PDFs to Media Library. The container alone is not an anonymous RCE. A form plugin, a low-priv account, or any other upload-then-preview path is.[1]

Failed PoCs in their form test still returned a successful upload; Ghostscript crashed in the background. WordPress core retries PDF preview (Trac #48853, since 5.6): they measured one gs process for a harmless PDF and two for a crashing one.[1]

HEIF Heist / libheif is analogy in that article, not evidence this CVE is being adapted. Wordfence says so. We are not inflating it.[1]

Hunt the fleet - package revision, then who can upload PDFs

# lies (and 10.08.0rc1 also prints 10.08.0)
gs --version

# Debian / Ubuntu - this is the number that matters
dpkg -s ghostscript | grep -E '^Version:|^Status:'

# RHEL / Alma / Rocky / CloudLinux
rpm -q ghostscript
rpm -q --qf '%{NAME}-%{VERSION}-%{RELEASE}\n' ghostscript

Floors we re-read this morning. Take current security repo, not "just past the CVE range."

Distro Advisory Floor we actually saw Notes
Ubuntu 22.04 jammy USN-8791-1 (21 Sep 2026) 9.55.0~dfsg1-0ubuntu5.14 gs --version still 9.55.0
Ubuntu 24.04 noble same USN 10.02.1~dfsg1-0ubuntu7.9
Ubuntu 26.04 resolute same USN 10.06.0~dfsg-3ubuntu1.1
Ubuntu 20.04 focal Ubuntu CVE page Needs evaluation Do not invent a jammy backport
Debian 13 trixie tracker / DSA-6516-1 security 10.05.1~dfsg-1+deb13u3 (fixed ≥ …+deb13u2) unattended-upgrades, then check
Debian 12 bookworm tracker this morning 10.0.0~dfsg-11+deb12u8 vulnerable no fixed version listed
RHEL / clones 8 RHSA-2026:76877 (6 Oct) ghostscript-9.27-18.el8_10 RHSA title Moderate
RHEL / clones 9 RHSA-2026:74457 (2 Oct) ghostscript-9.54.0-19.el9_8.1
RHEL 10 / Alma 10 RHSA-2026:74464 / ALSA-2026:74464 ghostscript-10.02.1-16.el10_2.1 Alma page we fetched
Upstream gs10080 10.08.0 final, not rc1

Ubuntu: apt-get install --only-upgrade ghostscript libgs9 libgs10 for the packages USN names on that release, then restart php-fpm / the panel PHP handler / any long-lived converter.[5][6] Containers: rebuild from a new base, do not restart the old layer. RHEL 8/9 floors are those RHSAs.[12][13] Alma 10 is ALSA-2026:74464.[14] Debian 12 is still listed vulnerable.[7]

# shared hosting: who even has gs, and which binary
find /home /var/www /opt /usr -name 'gs' -type f 2>/dev/null
php -m | grep -i imagick
# WordPress Site Health → Info → Media Handling can show Imagick PDF - Wordfence: that is not proof of policy or of the patch

If a site (or any tenant on the box) lets visitors or low-priv users upload PDFs and something builds a preview, treat the host as exposed until the package revision matches the table. Shared images / EA4 / Docker layers mean one gs serves hundreds of vhosts.[1]

Cannot patch immediately (Wordfence's mitigations, not a substitute):

  • Stop accepting PDFs from visitors and low-priv accounts.
  • Disable PDF reads in ImageMagick's security policy (this also kills previews).
  • Rate-limit uploads. That cuts retry count. It does not close the overflow.
  • Do not treat -dSAFER as a fix.

Honesty / What We Could Not Verify

  • We did not exploit this. No PDF was submitted. No gs was crashed in this lab. Overflow geometry, 1,029-byte file, 10,240-run table, and the WordPress RCE demo are Wordfence's, quoted as their telemetry.
  • Not on CISA KEV as of catalog 2026.10.14 / count 1745. We re-read that JSON this morning.[10]
  • Not claimed in-the-wild. Wordfence, 12 Oct: no public evidence of exploitation today. We found no later Patchstack/CISA campaign write-up for 39919 this morning.[1]
  • NVD has not scored it. Status Awaiting Analysis. 9.8 is CNA/Secondary, not an NVD v3.1 object.[4]
  • Red Hat is Moderate, vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, vs CNA AV:N / UI:N. We are not "correcting" either score. RHSA-2026:76877 is titled Moderate.[11][12]
  • Debian 12. Tracker this morning still lists bookworm 10.0.0~dfsg-11+deb12u8 as vulnerable. If that page moves later today, trust the tracker, not this sentence.[7]
  • Two patch commits. CVE.org → 0a8bf88. Debian notes → 8ddaa67 on ghostpdl-10.08.0. Untested whether they are the same diff.[9][7]
  • Wordfence's Sept 15 package table is stale relative to USN-8791-1, Debian security, and the October RHSAs. We used today's advisory pages for floors, their table only for "what was vulnerable on Sept 15."[1][6]
  • Ubuntu 20.04 / 18.04 / 16.04: Ubuntu page says Needs evaluation. No floor invented.[5]
  • cPanel / Plesk / CloudLinux changelog. We did not find a panel-specific advisory this morning. CloudLinux/Alma 8-9 should follow the RHEL errata in the table; confirm with rpm -q. EasyApache custom gs is a separate binary - hunt it.
  • RCE ≠ root. Wordfence: code execution is the account processing the PDF. CageFS / PHP-FPM pool isolation still matters. We did not test a CageFS breakout.
  • Official WordPress Docker. We did not pull today's image. Wordfence's finding is a Sept 15 snapshot.
  • Bugzilla 709666 is cited by CVE.org; we did not need a login-walled body for the floors above.[15]

What this is not

  • Not CVE-2026-85097 (Bricksforge unauth PHP upload). Different process, different patch.
  • Not CVE-2026-94504 / 93836 (Ninja Forms / WPC stored XSS → hidden admin). Plugin slugs, not gs.
  • Not libheif / HEIC upload RCE. Same class (native decoder under WordPress uploads). Different library, different package.
  • Not a Proxmox / LiteSpeed / cPanel / Plesk KEV. No new named-stack KEV on 14 Oct.[10]
  • Not "9.8 so every PDF is a webshell." Wordfence's own cross-build study argues build-matched exploitation, which is exactly why a hosting fleet on one image should patch first.

Sources

[1] https://www.wordfence.com/blog/2026/10/wordfence-argus-discovers-critical-vulnerability-in-ghostscript-the-program-that-turns-uploaded-pdfs-into-thumbnails-on-your-server - Wordfence Argus Ghostscript CVE-2026-39919 [2] https://www.cve.org/CVERecord?id=CVE-2026-39919 - CVE.org CVE-2026-39919 [3] https://cveawg.mitre.org/api/cve/CVE-2026-39919 - CVE AWG JSON CVE-2026-39919 [4] https://nvd.nist.gov/vuln/detail/CVE-2026-39919 - NVD CVE-2026-39919 [5] https://ubuntu.com/security/CVE-2026-39919 - Ubuntu CVE-2026-39919 [6] https://ubuntu.com/security/notices/USN-8791-1 - USN-8791-1 Ghostscript [7] https://security-tracker.debian.org/tracker/CVE-2026-39919 - Debian tracker CVE-2026-39919 [8] https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080 - Ghostscript 10.08.0 release [9] https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1 - Artifex patch commit 0a8bf88 [10] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV JSON [11] https://access.redhat.com/security/cve/CVE-2026-39919 - Red Hat CVE-2026-39919 [12] https://access.redhat.com/errata/RHSA-2026:76877 - RHSA-2026:76877 RHEL 8 [13] https://access.redhat.com/errata/RHSA-2026:74457 - RHSA-2026:74457 RHEL 9 [14] https://errata.almalinux.org/10/ALSA-2026-74464.html - ALSA-2026:74464 AlmaLinux 10 [15] https://bugs.ghostscript.com/show_bug.cgi?id=709666 - Ghostscript Bugzilla 709666

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales