CVE-2026-39919 is a heap-based buffer overflow in Ghostscript's JPEG 2000 path, scored CVSS 9.8. Artifex fixed it in Ghostscript 10.08.0, released 8 September 2026. Wordfence published the finding on 12 October after its Argus system found the bug on 23 August. BleepingComputer carried the story on 13 October.

What happened

The bug sits in base/sjpx_openjpeg.c. A PDF that embeds a JPEG 2000 image with mismatched component subsampling can make the decoder allocate a row buffer sized for packed sub-byte samples, then write a full byte per sample. Wordfence's test case used 1,024 two-bit samples: a 256-byte allocation and a 1,024-byte write. That corrupts Ghostscript's chunk-allocator metadata. The write still happens when Ghostscript is started with -dSAFER.

Wordfence turned the corruption into unauthenticated remote code execution on a purpose-built WordPress test site. There is no WordPress plugin to update. The vulnerable code is the system Ghostscript package that many hosts call when a site, DAM, or mail gateway turns an uploaded PDF into a thumbnail or preview. Wordfence says it has no public evidence of exploitation. The CVE record credits Alex Thomas of Wordfence and Wordfence Argus.

Who is affected

• Ghostscript 9.21 through 10.07.1 where the OpenJPEG decoder is present
• Anything that shells out to gs, ghostscript, or ImageMagick/GraphicsMagick policy that still allows PDF and PS
• WordPress and other CMS hosts that generate PDF thumbnails on upload

Upstream fix is 10.08.0. Linux distributions are shipping their own package versions. SUSE, for example, published an errata on 13 October rather than jumping every host to the upstream tarball. Match the vendor package, not a random GitHub build.

What to do now

Inventory every host that renders untrusted PDFs and upgrade Ghostscript to 10.08.0 or the distro package that contains the fix. On WordPress and shared hosting, that is an OS package update, not a plugin update. Until the package is current, disable PDF thumbnail generation or block PDF uploads on public forms.

Also check ImageMagick policy.xml. If PDF and PS are still coded as allowed, a web upload can reach Ghostscript even when the application never names it. There is no KEV entry and no public exploitation report as of this brief. The CVSS and the WordPress proof still make this a this-week patch for any server that accepts PDFs from customers.

Source: Wordfence, Wordfence Argus discovers critical Ghostscript vulnerability. CVE record: CVE-2026-39919.

Also on the blog

• CVE-2026-104935: Ivanti Connect Secure auth bypass exploited since Oct 3
• CVE-2026-96951: Windows Shell MOTW bypass exploited, patch by 16 Oct
• GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE
• CVE-2026-105445: Docker Hub PAT reassigned to another user

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.