ARTIFEX Software released Ghostscript 10.08.0 on 8 September 2026 to fix a critical heap buffer overflow in the JPEG 2000 image decoder used when Ghostscript processes PDFs and PostScript. The vulnerability, tracked as CVE-2026-39919, can enable unauthenticated remote code execution via crafted PDFs. Wordfence’s Threat Intelligence team demonstrated two working exploits in lab conditions, but found no public evidence of exploitation in the wild to date. The CVSS metrics cited are 9.8 (CVSSv3) and 9.3 (CVSSv4), with Wordfence noting the score reflects worst‑case potential rather than a guaranteed outcome.
Exposure extends beyond WordPress: any server or service that relays untrusted PDFs to Ghostscript—including document management systems, print services, invoice processors, mail gateways, and conversion APIs—could be affected. On WordPress specifically, risk arises when a site accepts PDFs from visitors, generates a preview or thumbnail via Imagick/ImageMagick, and runs Ghostscript without the fix.
The vulnerability is not WordPress‑specific, and there is no vendor plugin update; patching requires updating the system package or container image to 10.08.0. Administrators should verify full package revisions (not just gs --version) and, if patching is not immediate, apply mitigations such as restricting PDF uploads and isolating document processing. Ubuntu and Debian have issued fixes in various releases, while other distributions vary in status. Continuous monitoring remains advised as exploit activity evolves.