PDF Architect CVE-2025-14418

Exploitation requires the victim to open an attacker-supplied XLS file (or visit a malicious page that serves one) in pdfforge PDF Architect; the core condition is that PDF Architect's XLS processing executes embedded/dangerous script without displaying a user warning (CWE-356), so no explicit 'enable macros' prompt limits the attacker. Limiting factors: the attack vector is LOCAL (the file must be opened on the target host, not reachable over a network service), mandatory user interaction is required (UI:R), and attack complexity is HIGH (AC:H), indicating conditions outside the attacker's control (e.g., specific file handling or timing) reduce reliability. Confirmed affected build is 9.1.74.23030; other versions were not enumerated in the input.

This is a moderate-priority, context-of-current-user code execution flaw rather than a drop-everything emergency. The ZDI/NVD CVSS 3.0 vector (AV:L/AC:H/PR:N/UI:R/S:U, 7.0 High) tells a consistent story: although 'RCE' sounds remote, the attack vector is LOCAL - the victim must open a malicious XLS file or visit a malicious page that delivers one - and attack complexity is HIGH (AC:H), meaning exploitation is not trivially reliable. No special privileges are needed (PR:N) but user interaction is required (UI:R), and scope is unchanged (code runs only as the current user, not elevated). Impact is high across C/I/A because arbitrary code execution is achieved. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation - consistent with a freshly disclosed ZDI advisory (ZDI-CAN-27502 / ZDI-25-1075). Signals are internally consistent: the 'remote attacker' framing in the description is reconciled by UI:R + AV:L (attacker is remote in the sense of delivering a file, but execution is local). The main uncertainty is the absence of exploitation-probability data (no EPSS) and the lack of a detailed vendor advisory beyond the ZDI page.

An attacker crafts a malicious XLS file embedding dangerous script and lures a PDF Architect user into opening it (e.g., via phishing email attachment or a malicious web page). Because PDF Architect executes the embedded script without presenting a user warning, arbitrary code runs in the context of the current user. No public exploit was identified at time of analysis, and the high attack complexity (AC:H) means exploitation may not be fully reliable.