Ghostscript vulnerabilities allow remote code execution via PDF uploads

Security researchers have identified three critical vulnerabilities in the Ghostscript interpreter and rendering engine that could allow attackers to hijack servers. The most severe flaw, CVE-2026-39919, is a heap buffer overflow in the JPEG 2000 output adapter that carries a CVSS score of 9.3. This vulnerability allows unauthenticated remote code execution when a server processes a specially crafted PDF file.

Additional flaws include CVE-2026-101258, which allows attackers to bypass the -dSAFER sandbox to run shell commands, and CVE-2026-103226, a stack-based buffer overflow in the Pdfwrite component. Because many major platforms—including Wikipedia, Steam, Microsoft OneDrive, and Mozilla’s Pocket—use Ghostscript through ImageMagick for document and image processing, millions of servers may be at risk.

Attackers can potentially bypass file extension filters by renaming malicious PostScript files as .jpg images, as ImageMagick identifies files by content. Patches for these vulnerabilities are available in Ghostscript version 10.08.0, with Red Hat and SUSE having already released fixes for their respective systems.