Ghostscript exploit tests expose server risk from crafted PDF uploads
Image: Primary Wordfence researchers developed two exploits for a Ghostscript flaw that could let attackers execute code on servers processing crafted PDFs, BleepingComputer reported. The vulnerability, CVE-2026-39919, affects versions 9.21 through 10.07.1 and corrupts memory when the software handles certain JPEG 2000 images inside PDFs.
The researchers achieved remote code execution on a purpose-built test server, but failed to do so in 10,240 executions against Linux packages. Success required changes to the test environment and remained unreliable.
Artifex fixed the flaw in version 10.08.0 on September 8 and backported fixes. Exposure depends on an application accepting attacker-supplied PDFs and rendering them through vulnerable Ghostscript code. Wordfence reported no observed exploitation in the wild.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
