A critical heap buffer overflow vulnerability (CVE-2026–39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files.

The flaw was discovered on August 23 by researchers at Defiant’s platform Wordfence using their Argus AI-powered system.

Ghostscript is a PostScript and PDF interpreter that can render PDFs as images, generate thumbnails for previews, and optimize PDF files by compressing embedded images and removing unnecessary font data.