Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server 

On September 8, 2026, Artifex released Ghostscript 10.08.0, closing a critical heap buffer overflow that the Wordfence Threat Intelligence team, using Wordfence Argus, discovered and reported sixteen days earlier. It is tracked as CVE-2026-39919 and carries a CVSS score of 9.8 out of 10. A crafted PDF containing a JPEG 2000 image can make Ghostscript write attacker-influenced bytes past the end of a memory buffer. We developed that corruption into unauthenticated remote code execution on a purpose-built WordPress test site.
The post Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server appeared first on Wordfence.WordfenceRead More