# Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server

Heap buffer overflow in Ghostscript's JPEG 2000 decoder: sub-byte samples with mismatched component resolutions overflow a packed row buffer, yielding RCE via crafted PDF.

- Payout: Research
- Severity: critical
- Program: Ghostscript
- Found by (vendor credit): Alex Thomas, Wordfence, Wordfence Argus
- Write-up by: Alex Thomas
- Disclosed: 2026-10-12
- CVE: CVE-2026-39919
- Write-up quality: 8/10
- Original: https://www.wordfence.com/blog/2026/10/wordfence-argus-discovers-critical-vulnerability-in-ghostscript-the-program-that-turns-uploaded-pdfs-into-thumbnails-on-your-server/
- Library page: https://bugbountylibrary.com/r/blog%3Awordfence-com-blog-2026-10-wordfence-argus-discovers-critical-vulnerability-in-ghostscript-the-program-that-turns-upload
- Tags: area:web domain:oss domain:web impact:rce kind:research platform:research sev:critical tech:php technique:chained technique:source-review vuln:file-upload vuln:memory-corruption vuln:rce

**Target:** Ghostscript JPEG 2000 (OpenJPEG) decoder reached via PDF-to-thumbnail rendering (WordPress/Imagick/ImageMagick)
**Root cause:** When decoding JPEG 2000 with sub-byte sample precision and mismatched component resolutions, the row-fill loop writes one byte per sample instead of packing samples into bytes, overflowing a correctly-sized 256-byte heap buffer by 768 bytes per row into memory-management bookkeeping.
**Steps:**
1. Craft a PDF containing a valid JPEG 2000 image with a transparency component whose resolution differs from the color components and sub-byte (e.g. 2-bit) sample precision.
2. Minimal test case: 1,024 two-bit samples per row -> 256-byte buffer allocated, loop writes 1,024 bytes.
3. Deliver the PDF to any path that renders it via Ghostscript (e.g. WordPress Media Library preview through Imagick/ImageMagick).
4. Observe Ghostscript crash; with a build-matched exploit, corrupted allocator bookkeeping is steered to code execution under the web server account, even with `-dSAFER`.
**How found:** Argus traced an uploaded file past the PHP upload handler through Imagick and ImageMagick into Ghostscript's JPEG 2000 decoder, hypothesizing that a mundane document-upload feature reaches native parsing code several layers down; then reduced to a 1,029-byte PDF differing from a control by one byte in the transparency component's resolution field.
**Exploitation:** Attacker uploads a crafted PDF to a form/route that triggers thumbnail generation; WordPress calls Imagick -> ImageMagick -> Ghostscript, which overflows the heap during JPEG 2000 decode. Attacker-influenced sample bytes overwrite allocator metadata used during cleanup, and a build-specific PoC turns this into unauthenticated RCE as the Ghostscript process user. Two PoCs worked only on the matching build; 10,240 attempts across ten other package environments failed.
**Escalation:** Build-matched exploit reused across all four setups sharing the identical Ghostscript executable; threat model is targeted attack on a known build or mass attack on hosts sharing one container image.
**Insight:** Follow uploaded-file data past the visible handler into native converters (ImageMagick/Ghostscript); the trigger can hide in image internal geometry (component resolution mismatch + sub-byte precision) so MIME/extension checks never see it, and a one-byte diff from a valid control file is enough.