# Ghostscript exploit tests expose server risk from crafted PDF uploads

_Published Tuesday, October 13, 2026 at 5:45 PM EDT · Security · Latest · Tier 2 — Notable_

![Ghostscript exploit tests expose server risk from crafted PDF uploads — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/13/ghostscript.jpg)

Wordfence researchers developed two exploits for a Ghostscript flaw that could let attackers execute code on servers processing crafted PDFs, BleepingComputer reported. The vulnerability, CVE-2026-39919, affects versions 9.21 through 10.07.1 and corrupts memory when the software handles certain JPEG 2000 images inside PDFs.

The researchers achieved remote code execution on a purpose-built test server, but failed to do so in 10,240 executions against Linux packages. Success required changes to the test environment and remained unreliable.

Artifex fixed the flaw in version 10.08.0 on September 8 and backported fixes. Exposure depends on an application accepting attacker-supplied PDFs and rendering them through vulnerable Ghostscript code. Wordfence reported no observed exploitation in the wild.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/ghostscript-flaw-lets-hackers-hijack-servers-via-pdf-uploads/)

---
Canonical: https://techandbusiness.org/newswire/kCSjm5PBabyDT8dKbqx8CU
Published: 2026-10-13T21:45:54.631Z
Story chronology: 2026-10-13T21:33:26.000Z
Retrieved: 2026-10-14T00:09:15.087Z
Publisher: Tech & Business (techandbusiness.org)