Three Ghostscript Flaws Let Hackers Hijack Servers Through a Single PDF

Three critical Ghostscript vulnerabilities now put millions of servers at risk. Attackers can exploit these flaws by uploading a malicious PDF or PostScript file to any web service that uses Ghostscript for document processing. A public proof-of-concept exploit already exists for at least one of them, TechJuice reported.

The most severe flaw, CVE-2026-39919, scores a critical 9.3 on the CVSS v4 scale. This heap buffer overflow sits in Ghostscript’s JPEG 2000 output adapter. When a server processes a crafted PDF with mismatched image subsampling values, the flaw corrupts chunk-allocator metadata. As a result, attackers can achieve remote code execution without any authentication.

How the Ghostscript vulnerabilities work

The second flaw, CVE-2026-101258, carries a CVSS score of 8.5. It lets attackers bypass Ghostscript’s -dSAFER sandbox entirely. The exploit chains a type 5 shading out-of-bounds write with a use-after-free of a procedure stream. Once the sandbox falls, attackers can run shell commands directly on the server. Security researchers at v12-security have already published a proof-of-concept exploit on GitHub.

A third flaw, CVE-2026-103226, targets the Pdfwrite component through a stack-based buffer overflow in the type1_callsubr function. According to Debian’s security tracker, a public exploit for this flaw already exists and “might be used”.

The real danger extends far beyond Ghostscript itself. Major platforms like Wikipedia, Steam, Microsoft OneDrive and Mozilla’s Pocket service all use Ghostscript through ImageMagick for image processing. Furthermore, ImageMagick identifies files by their content rather than their extension. So an attacker can rename a malicious PostScript file as a .jpg image, and ImageMagick will still send it to Ghostscript for processing.

A related flaw, CVE-2026-108693, also affects ImageMagick on Windows specifically. This vulnerability lets attackers plant a malicious Ghostscript executable that runs with ImageMagick’s privileges during PDF conversion.

Update now: patches and workarounds

All three flaws receive patches in Ghostscript version 10.08.0. Red Hat has already shipped fixes for RHEL 8, 9 and 10 between October 1 and October 6. SUSE also released an advisory on October 8 rating CVE-2026-39919 as “important”. However, Debian Bookworm and several Amazon Linux releases still show pending fixes.

Server administrators should update Ghostscript to version 10.08.0 immediately. Teams should also sandbox any service that processes untrusted documents and disable PostScript handling in ImageMagick’s policy.xml where possible.

For Pakistan, the warning has practical bite. Government portals, university admission systems and banking apps routinely accept document uploads from the public, and many run on Linux stacks where Ghostscript and ImageMagick sit quietly in the background. The recent cybersecurity MoU between NCERT and HEC shows universities are already thinking about hardening their systems; unpatched document pipelines are exactly the kind of soft target attackers probe first.

What is Ghostscript?

Ghostscript is an open-source interpreter for PDF and PostScript files, widely used by servers and applications to convert, render and process documents behind the scenes.

Which versions are affected?

Versions before 10.08.0 are vulnerable. Administrators should upgrade to Ghostscript 10.08.0, which patches all three flaws.

How can I protect my server?

Update immediately, sandbox services that handle untrusted uploads, and disable PostScript processing in ImageMagick’s policy.xml if your application does not need it.