PDF Architect CVE-2025-14416

Exploitation requires a user to open an attacker-supplied malicious DOC file in pdfforge PDF Architect (confirmed affected build 9.1.74.23030), or visit a page that delivers one; the specific trigger is PDF Architect's DOC-file processing path, which permits execution of dangerous embedded script without displaying a security warning (CWE-356, Insufficient UI Warning). Limiting factors that reduce real-world risk: mandatory user interaction (UI:R - the victim must actively open the file), high attack complexity (AC:H, implying non-trivial conditions beyond attacker control must be met), and a local attack vector (AV:L) meaning there is no remotely reachable network service - delivery relies on social engineering. Code executes only with the privileges of the current user, not elevated/system context (S:U).

This is a moderate-risk, client-side code-execution flaw that is a genuine but non-urgent priority. The CVSS 3.0 score of 7.0 (HIGH) is driven by full C:H/I:H/A:H impact, but the attack vector is heavily constrained: AV:L (local), AC:H (high complexity), and UI:R (user interaction required). PR:N confirms no authentication is needed, but exploitation depends entirely on convincing a user to open a malicious DOC file in PDF Architect. There is a notable signal conflict: the CVSS vector specifies AV:L (local), yet the description characterizes the threat as 'remote attackers' who deliver a 'malicious page or malicious file' - this is ZDI's standard modeling of file-open/client-side RCE as local vector plus required interaction, so the practical delivery is remote-social-engineering rather than network-service exploitation. No EPSS score, KEV listing, or POC indicator is present in the supplied data. Exploitation status is therefore 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation not observed, not automatable (requires per-victim user interaction and the AC:H condition), technical impact total. Net assessment: real but low-velocity risk - patch in normal cadence rather than emergency, because the AC:H plus UI:R combination makes mass or automated exploitation unlikely.

An attacker crafts a malicious DOC file that embeds dangerous script content and distributes it via email, a download link, or a malicious web page. When a victim opens the file in pdfforge PDF Architect, the application executes the embedded script without presenting a security warning, running arbitrary code in the context of the current user. No public exploit code is identified in the available data, and the AC:H rating indicates the attacker must satisfy non-trivial conditions for reliable execution.