TLDR Tech / Practical
Critical Ghostscript flaw enables remote code execution
A severe vulnerability in Ghostscript, identified as CVE-2026-39919 and rated with a CVSS score of 9.8, has been uncovered by Wordfence. This flaw allows unauthenticated remote code execution through a specially crafted PDF containing a JPEG 2000 image. Artifex has released Ghostscript version 10.08.0 to fix the issue, which impacts versions 9.21 through 10.07.1 when the OpenJPEG decoder is enabled. Given that applications like WordPress may use Ghostscript for thumbnail generation via Imagick, updating system packages or rebuilding container images is recommended.
Read the full story