Ghostscript flaw lets PDF uploads trigger server compromise

Defiant's Wordfence team said Argus found the heap overflow on 23 August. The researchers said a malformed PDF could make Ghostscript write 1,024 bytes into a 256-byte buffer, corrupting memory and, in the right setup, allowing code execution.

Wordfence said it focused on WordPress scenarios because thumbnail generation can pass through PHP Imagick, ImageMagick and then Ghostscript. It said exploitation in that setting required a PDF upload, processing into a preview, a path to Ghostscript with the relevant settings, and the unpatched decoder.

The researchers said they tested ten Linux environments, including Debian, Ubuntu, Fedora, Alpine and AlmaLinux, plus an official WordPress Docker image snapshot, and found vulnerable code in each. They also said 10,240 attempts against Linux packages did not produce remote code execution in the lab, although a purpose-built test server did.

Artifex said it fixed the issue in Ghostscript 10.08.0 on 8 September and later backported patches to older versions. Wordfence said administrators should confirm patch levels, rebuild Docker images if needed, or block PDF uploads or disable PDF rendering if they cannot upgrade, and it said it had not seen exploitation in the wild.