Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server

On September 8, 2026, Artifex released Ghostscript 10.08.0, closing a critical heap buffer overflow that the Wordfence Threat Intelligence team, using Wordfence Argus, discovered and reported sixteen days earlier. It is tracked as CVE-2026-39919 and carries a CVSS score of 9.8 out of 10. A crafted PDF containing a JPEG 2000 image can make Ghostscript write attacker-influenced bytes past the end of a memory buffer. We developed that corruption into unauthenticated remote code execution on a purpose-built WordPress test site.

If you run a WordPress site, there isn’t a WordPress plugin to update. Ghostscript is supplied by the operating system