DEV Community

Anoymask
Anoymask

Posted on

Ghostscript CVE-2026-39919: Build-Dependent RCE via JPEG 2000 Heap Overflow

#security #threatintel

1. Basic Information

2. Executive Summary

A crafted JPEG 2000 image inside a PDF causes Ghostscript to write 1,024 bytes into a 256-byte buffer, corrupting memory. While Wordfence demonstrated pre-authentication RCE on a specifically built WordPress test environment, the same exploit failed across 10,240 attempts in 10 other environments, and active exploitation has not been confirmed.

3. Attack Flow

The following path details the observed and tested exploitation mechanics. Confirmed facts, reproduction tests, and feasibility are distinguished below.

From Crafted PDF to Ghostscript Code Execution

  1. An attacker embeds a JPEG 2000 image with sub-byte samples and mismatched component resolution into a PDF.
  2. The PDF is submitted to a target service via a public form, low-privileged account, email, or API.
  3. The application generates previews, thumbnails, or performs conversions, invoking Ghostscript via Imagick, ImageMagick, or similar wrappers.
  4. Ghostscript writes 1,024 bytes into a 256-byte heap buffer, corrupting memory management structures with attacker-influenced data.
  5. If the exploit aligns with the target build, arbitrary code executes under the context of the document processor or web server account.

4. Attacker Positioning and Execution Location

  • A remote attacker capable of submitting untrusted PDFs to the target application. Authentication requirements depend on the implementation of the upload mechanism, email ingestion, or API endpoints.

5. Victim and Administrator Perspective

  • Users: Uploads may succeed while thumbnail generation fails, previews do not load, or processing errors occur.
  • Administrators: Symptoms include PDF intake actions, Ghostscript process crashes, segmentation faults, retried files, unexpected child processes, and converter account egress traffic.

6. Conditions for Success and Failure

Conditions for Success

  • Ability to submit untrusted PDFs via upload, email, or API.
  • The application processes the PDF for previews, thumbnails, or conversion, reaching vulnerable Ghostscript code paths.
  • An exploit payload tailored to match the target build, libraries, fonts, and memory layout.

Failure Conditions and Mitigations

  • Update to Ghostscript 10.08.0 final or backported packages, followed by process restarts or container rebuilds.
  • Suspend untrusted PDF uploads or PDF rendering while systems remain unpatched.
  • Isolate the document converter from internal networks and secrets, minimizing egress permissions and execution privileges.

7. Impact of Successful Exploitation

  • Remote code execution under the privileges of the Ghostscript or document processor account.
  • Access to application secrets, documents, and the underlying filesystem, along with the execution of secondary payloads.
  • Crashes or reduced availability of the PDF conversion service.

8. Observable Logs

The following areas should be reviewed during internal investigations. Confirmed facts from public disclosures are distinguished from telemetry required for internal verification.

  • Email: For mail gateways rendering attached PDFs, check sender addresses, message IDs, attachment hashes, and preview errors.
  • Proxy / SWG / DNS: Monitor PDF upload and conversion APIs, repeated submissions from identical sources, and anomalous egress from converter hosts.
  • Endpoint / EDR: Inspect process trees for gs, ghostscript, convert, magick, and PHP-FPM or web server processes, along with segmentation faults, core dumps, and unexpected child processes.
  • Identity / IdP: Review low-privileged upload accounts, anomalous service account access, and credential usage following RCE events.
  • SaaS / Cloud: Check object storage uploads, document conversion jobs, container restarts, serverless invocations, and image digests.
  • Network: Track PDF submissions to converters, outbound DNS and HTTPS traffic around crash events, and internal scanning activity.

9. Determining Attack Success

Confirmed in Public Disclosures

Initial Execution Confirmed

  • Scope: Purpose-built laboratory WordPress deployment.
  • Basis: Wordfence demonstrated unauthenticated RCE on a specifically built WordPress test site. However, the same two PoCs failed across all 10,240 execution attempts in 10 different Linux package environments, succeeding only conditionally and unreliably across 4 matching configurations.

Internal Assessment Criteria

  • Correlate requests, responses, processes, authentication, data access, and outbound traffic chronologically to distinguish exposure from actual compromise.
  • Do not infer successful exploitation based solely on individual alerts lacking corroborating evidence.

10. Investigation Playbook

  • Investigation Trigger: Base investigations on CVE-2026-39919 detections, Ghostscript crashes, PDF preview failures, or converter host child processes and egress.
  • Initial Verification: Confirm exact Ghostscript package revisions, distinguishing 10.08.0rc1 from final releases, review PDF processing chains, and check for anonymous or low-privileged upload capabilities.
  • Endpoint / Server Analysis: Preserve PDF hashes, core dumps, Ghostscript command lines, fonts and libraries, container images, process trees, and newly written files.
  • Authentication / Cloud Analysis: Verify upload accounts, service identities, secret access, object storage logs, cloud APIs, and authentication tokens originating from converters.
  • Post-Exploitation Tracking: Trace shells, downloaded files, credential access, internal scanning, webshells, and data exfiltration.
  • Containment: Halt or isolate PDF processing workflows, update to patched packages, rebuild containers, and rotate converter credentials.
  • Triage Classification: Categorize findings into malicious PDF receipt, Ghostscript reached, crashes, code execution, credential or data access, and secondary compromises.

11. Defense and Detection Ideas

  • Single Events: Detect Ghostscript segmentation faults immediately following PDF processing tasks, anomalous JPEG 2000 geometry, or shells and network utilities spawned by converters.
  • Chronological Correlation: Correlate PDF uploads, preview jobs, Ghostscript execution, crashes or child processes, and outbound communications using file hashes and job IDs.
  • Threat Hunting: Search for Ghostscript versions 9.21 through 10.07.1, unpatched distribution packages, version 10.08.0rc1, public upload routes, and shared container images.
  • Log Limitations: Application access logs alone are insufficient to confirm lower-level Ghostscript crashes or code execution; process telemetry, core dumps, and container logs are required.
  • Priority Actions: Deploy patched packages, rebuild containers, halt untrusted PDF processing, apply converter sandboxing and network isolation, and implement file count rate limits.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-39919 is a heap-based buffer overflow in Ghostscript's JPEG 2000 decoding path, affecting versions 9.21 through 10.07.1, including those using the OpenJPEG path.
  • When sub-byte sample precision and mismatched component resolutions are combined, Ghostscript allocates 256 bytes but writes 1,024 bytes, overwriting 768 bytes of heap memory.
  • Because vulnerability conditions reside in the geometry embedded within the PDF and JPEG 2000 data, they cannot be identified by inspecting file extensions, MIME types, or basic structures alone.
  • Wordfence demonstrated unauthenticated code execution with -dSAFER enabled on a purposely built WordPress test site.
  • The same two PoCs failed across 10,240 execution attempts on 10 separate Linux package environments, succeeding unreliably only on 4 configurations sharing identical build characteristics.
  • Inspections of public WordPress Docker images revealed vulnerable Ghostscript installations and PDF preview chains, though stock WordPress installations do not permit anonymous PDF uploads.
  • Beyond WordPress, services such as document management systems, print services, invoice processors, mail gateways, and conversion APIs are affected if they pass untrusted PDFs to Ghostscript.
  • Artifex addressed the issue in Ghostscript 10.08.0 final. Because distributions backport fixes to older version numbers, checking full package revisions is required.
  • Wordfence has not confirmed active exploitation in real-world environments.

Inference

  • Environments deploying identical container images or hosting builds at scale face risks of build-specific exploits being reused across multiple servers.
  • Successful upload responses alone do not indicate preview subprocess crashes or RCE; Ghostscript process logs must be correlated with file-processing telemetry.

Hypothesis

No additional hypotheses. Unconfirmed items are documented in section 14.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Memory corruption is reached via public applications that accept untrusted PDFs and preview them using Ghostscript.

14. Unresolved Questions and Further Investigation

  • The practical difficulty of remotely identifying target Ghostscript builds and adapting exploits accordingly.
  • The scale of internet-exposed services that pass untrusted PDFs to Ghostscript.
  • The presence of public exploits and the timeline for active exploitation.

15. Impact on SOCs and Organizations

Organizations operating websites, document management systems, invoice processors, mail gateways, and PDF conversion APIs should inventory their dependencies, checking not only direct requirements but also Ghostscript usage via Imagick and ImageMagick. Update to Ghostscript 10.08.0 final or vendor-backported packages, and rebuild and redeploy containers without relying on build caches. Until updates are applied, halt untrusted PDF previews and isolate converter environments.

16. Summary by Role

  • SOC Teams: Correlate PDF uploads, Imagick and ImageMagick calls, Ghostscript execution, crashes, child processes, and egress traffic. Do not assume safety based solely on successful upload responses.
  • Administrators: Update to Ghostscript 10.08.0 final or distribution-patched versions and rebuild containers. Suspend PDF previews if updates cannot be applied immediately.
  • Users: Users of PDF upload features require no action for normal workflows. Contact administrators if persistent, unexplained upload errors occur.

Top comments (0)