PDF Architect CVE-2025-14419

Exploitation requires the victim to open an attacker-crafted PDF file in pdfforge PDF Architect (confirmed affected build 9.1.74.23030), or visit a malicious page that delivers such a file - the flaw lives specifically in PDF file-parsing where user-supplied data is not properly validated. The decisive limiting factor is the mandatory user interaction (UI:R): the attack cannot fire without the target actively opening the malicious document, and the Local vector (AV:L) means there is no remote network-service exposure. No special product configuration is required beyond running the vulnerable version; code executes only at the privilege level of the user who opens the file, so impact is bounded by that user's context (S:U, no privilege escalation implied).

This is a genuine but conditional threat whose signals are internally consistent rather than conflicting. The CVSS 3.0 vector (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8 HIGH) describes a client-side memory-corruption bug: the Local attack vector combined with required User Interaction confirms this is NOT a remotely-reachable network service flaw but a file/content-parsing issue that fires only when a victim opens attacker-controlled input. PR:N means no prior authentication is needed, and C:H/I:H/A:H reflect full arbitrary code execution in the context of the current user process. Crucially, several exploitation-pressure signals are ABSENT from the input: there is no EPSS probability, no CISA KEV listing, and no SSVC decision data provided, so active-exploitation likelihood cannot be quantified from this data. The source is Trend Micro ZDI (ZDI-25-1076, formerly ZDI-CAN-27902), a coordinated-disclosure program, which typically indicates a vendor-patched issue reported responsibly rather than one observed in the wild. No public exploit was identified at time of analysis. Net assessment: a legitimately severe (code-execution, no-auth) client-side vulnerability that should be patched, but one whose real-world urgency is tempered by the user-interaction requirement and the complete absence of exploitation-in-the-wild indicators - prioritize for patching on endpoints running the affected build, but it does not carry emergency/actively-exploited urgency based on available data.

An attacker crafts a malformed PDF that triggers a memory-corruption condition in PDF Architect's file-parsing routines and delivers it via email attachment, download link, or a malicious web page. When the victim opens the file (or visits the page) in a vulnerable installation, the parser mishandles the attacker-supplied data and executes arbitrary code in the context of the current user. No public proof-of-concept exploit was identified at time of analysis.