A PDF That Reads You Back: CVE-2026-39919 Turns Document Thumbnails Into Remote Code Execution
Upload forms are the attack surface people stop looking at On August 23, researchers at Defiant’s platform Wordfence discovered a critical heap buffer overflow (CVE-2026-39919) in Ghostscript, the PostScript and PDF interpreter. The failure mode is simple to describe and hard to accept: a PDF, uploaded and rendered by your own server, executing code on…