Act
active
Ghostscript heap overflow enables RCE via crafted PDF uploads
- Engineer — Act: A public PoC on GitHub makes exploitation of this critical heap buffer overflow practical; audit any server-side document or image-processing pipelines that invoke Ghostscript, and patch to the fixed version immediately or restrict PDF upload endpoints until patching is complete.
- SOC/IR — Plan: No active exploitation reported yet, but the public PoC shortens the window; build detections for anomalous Ghostscript process behavior — unexpected child process spawning or outbound network calls from Ghostscript — and baseline normal document-processing activity now.
- Leader — Skip
- Signals: CVE-2026-39919 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.