Critical Ghostscript Flaw Lets PDFs Execute Code

Ghostscript has a critical heap buffer overflow, CVE-2026-39919 (CVSS 9.8), that allows remote code execution through a specially crafted PDF.

The flaw is in Ghostscript’s rendering engine. A file upload endpoint, a document converter, or a CI pipeline that passes user-supplied PDFs to the engine can be exploited without any authenticated access. The exposure scales with how many services invoke Ghostscript on untrusted input. Ghostscript ships as a dependency in ImageMagick, LibreOffice, and many Linux server stacks, so the list of potentially exposed services is often longer than administrators expect.

BleepingComputer reports the vulnerability can be triggered through PDF uploads, with full remote code execution as the outcome.

The Ghostscript engine’s reach has surfaced in other CVE chains this year. A WordPress 7.0.4 RCE patched in August traced back to PostScript handling that routes through Ghostscript, pointing to how indirect the exposure can be.

Check the Artifex Ghostscript release page for a patched version addressing CVE-2026-39919. Where an immediate update isn’t possible, isolate or disable any service that passes untrusted PDFs to the Ghostscript engine, and review file upload endpoints and document processing pipelines that invoke Ghostscript directly or through ImageMagick.