---
title: Ghostscript CVE-2026-39919: a crafted PDF can get code execution in thumbnail pipelines | ctxsec
url: https://ctxsec.com/items/ghostscript-cve-2026-39919
description: ""
status: "confirmed (CVE record + vendor fix), not exploited"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/ghostscript-cve-2026-39919.md)

confirmed (CVE record + vendor fix), not exploited

2026-10-13

### Ghostscript CVE-2026-39919: a crafted PDF can get code execution in thumbnail pipelines

Heap buffer overflow in Ghostscript's JPEG 2000 output adapter (versions before 10.08.0; CVSS 3.1 9.8 from CNA VulnCheck). A PDF with mismatched JPEG 2000 component subsampling overflows a row buffer and corrupts allocator metadata. Wordfence found it with its AI-assisted Argus system and showed unauthenticated RCE through a WordPress → Imagick → ImageMagick → Ghostscript thumbnail chain on a purpose-built server; against stock distro packages in its lab, exploitation was not reliable. Artifex fixed it in 10.08.0 (Sept 8); check your distro's backports and rebuild container images. No in-the-wild exploitation reported. If you can't patch, block untrusted PDF uploads or disable PDF in the ImageMagick policy.

Sources: [CVE-2026-39919](https://www.cve.org/CVERecord?id=CVE-2026-39919) · [Artifex Ghostscript 10.08.0](https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080) · [VulnCheck advisory](https://www.vulncheck.com/advisories/ghostscript-heap-buffer-overflow-via-jpeg-2000-output-adapter) · [BleepingComputer](https://www.bleepingcomputer.com/news/security/ghostscript-flaw-lets-hackers-hijack-servers-via-pdf-uploads/)