PDF Architect CVE-2025-14417

Exploitation requires the victim to open an attacker-supplied file or visit a malicious page that is processed by PDF Architect, and specifically requires the PDF to contain a Launch action, which PDF Architect executes to run script without first displaying a user warning (the core defect). Limiting factors: mandatory user interaction (UI:R) - the attack cannot fire without the victim opening the content; the attack vector is local (AV:L), so there is no remote network-service exposure; and exploitation only affects installations of PDF Architect (CPE identifies version 9.1.74.23030). Code runs only in the context of the current user, so a low-privileged victim limits blast radius. No special server configuration is needed, but the user-interaction and local-file requirements significantly reduce the realistic attack surface compared with a network-exploitable flaw.

This is a file-format/client-side code execution flaw (CWE-356, Improper UI Layering/Insufficient UI Warning) in pdfforge PDF Architect, carrying a vendor/NVD CVSS 3.0 base score of 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The signals are mixed in an important way: the CVSS vector encodes AV:L (local attack vector), reflecting that exploitation requires the victim to open a malicious file or document locally, yet the description frames this as 'remote attackers' delivering a malicious page or file - this is the standard ZDI file-parsing pattern where delivery is remote but execution is local, so the AV:L is correct and the 'remote' wording refers to attacker origin, not network reachability. Low attack complexity (AC:L) and no privileges (PR:N) raise risk, but mandatory user interaction (UI:R) materially limits mass exploitation. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis; combined with the consumer-grade, niche footprint of the product, this reads as a genuine high-severity bug but a lower real-world priority than a server-side or ubiquitous-product RCE. Patch and SSVC (automatable, exploitation status) data were not supplied - verify fixed version with pdfforge/ZDI before final triage.

An attacker crafts a malicious PDF (or a web page that serves one) that abuses PDF Architect's Launch action to run a dangerous script without presenting any user warning. The victim opens the file in PDF Architect, and the embedded Launch action silently executes attacker-controlled code in the context of the current user. No public exploit code was identified in the provided data; the flaw was reported privately through Trend Micro's Zero Day Initiative (ZDI-CAN-27501 / ZDI-25-1074).