CriticalAPTCVE-2026-39919
Critical Ghostscript Flaw Lets Attackers Use Malicious PDFs to Execute Code
Cyber Security News·Source published ·1 min read
What happened?
A critical vulnerability in Ghostscript could allow attackers to use specially made PDF files to run code on vulnerable servers. The flaw, tracked as CVE-2026-39919, affects Ghostscript versions before 10.08.0 and has a CVSS severity score of 9.8 out of 10. Ghostscript is widely used to render PDFs, create document thumbnails, and convert PostScript files into images. The issue is especially important for websites and services that accept uploaded PDFs.
Key details
- Ghostscript has a critical flaw that lets specially crafted PDFs execute code on vulnerable servers.
- The vulnerability is a heap‑based buffer overflow in the JPEG 2000 image decoding path of Ghostscript.
- A crafted PDF can corrupt memory and, on some builds, cause unauthenticated remote code execution.
- The bug was introduced in Ghostscript 9.21 and affects all upstream versions up to 10.07.1.
- Artifex released Ghostscript 10.08.0 fixing the issue, and the CVE record confirms the patch.
- Services like WordPress, document portals, print and email gateways that invoke Ghostscript may be exposed.
Affected
- Ghostscript versions prior to 10.08.0 (from 9.21 through 10.07.1) are vulnerable.
Fixes and mitigations
- Rebuild container images from an updated base and redeploy instead of merely restarting containers.
What to look for
- No SHA‑256 hash of malicious samples has been disclosed.
- No command‑and‑control domain or IP address has been reported.
- Test PDF filenames were not published as campaign indicators.
- The CVE identifier confirms the Ghostscript package is fixed.
- Ghostscript 10.08.0 is the fixed upstream version released by Artifex.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.