Source: bleepingcomputer.com
A critical heap buffer overflow vulnerability tracked as CVE-2026-39919 has been discovered in the Ghostscript interpreter and rendering engine. The flaw allows attackers to achieve remote code execution by uploading specially crafted PDF files to vulnerable servers. Ghostscript is widely used for processing PostScript and PDF files across many platforms and applications. The vulnerability could allow remote attackers to effectively hijack servers that process PDF uploads. Given Ghostscript's widespread deployment in web applications, print servers, and document processing pipelines, the attack surface is significant. Organizations using Ghostscript-based document processing workflows are advised to apply patches promptly. The critical severity rating reflects the ease of exploitation via a common file format and the potential for full server compromise.
