Heap Buffer Overflow in Ghostscript Enables RCE via Crafted PDF
A critical heap buffer overflow in Ghostscript's rendering engine (CVSS 9.8) allows unauthenticated remote code execution via specially crafted PDF files.
- Vendor
- Artifex Software
- Product
- Ghostscript
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- unpatched
- Published
CVE-2026-39919 is a critical heap buffer overflow in the Ghostscript interpreter and rendering engine. An attacker who can deliver a malformed PDF to a service that processes it automatically can achieve remote code execution without authentication. CVSS score: 9.8.
Ghostscript ships as a dependency in ImageMagick, LibreOffice, and many Linux server stacks, so the exposure extends beyond services that explicitly advertise PDF handling.
See NVD for the full advisory. Check the Ghostscript release page for a patched version. Where an update isn’t immediately available, isolate any service passing untrusted PDFs to the Ghostscript engine.
