pdfforge PDF Architect CVE-2025-14420

Exploitation requires the victim to open an attacker-supplied CBZ (comic book archive) file in pdfforge PDF Architect, or visit a malicious page that delivers such a file - the vulnerable code path is specifically the CBZ file parser, which fails to validate user-supplied paths before using them in file operations (CWE-22 directory traversal). Limiting factors that reduce real-world risk: mandatory user interaction (UI:R - a user must actively open the crafted file), a local attack vector (AV:L - not remotely triggerable without delivering a file), and execution confined to the privileges of the current user (no privilege escalation or scope change, S:U). It only matters where PDF Architect is installed and used to open untrusted CBZ/archive content; the confirmed affected build is 9.1.74.23030.

This is a credible, moderate-urgency desktop client vulnerability rather than a mass-exploitation emergency. The CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) correctly characterizes it as a local, user-interaction-dependent flaw with full confidentiality, integrity, and availability impact - classic for a file-parsing RCE. The AV:L vector is consistent with the ZDI description, which requires the victim to open a malicious CBZ file or visit a malicious page, so despite 'remote attackers' being named this is NOT a remotely-reachable network service bug. No EPSS score, CISA KEV listing, or public POC is present in the provided data: exploitation status is therefore 'no public exploit identified at time of analysis,' and there is no evidence of active exploitation. The ZDI/Trend Micro sourcing (ZDI-CAN-27514, ZDI-25-1077) lends high credibility to the technical validity of the flaw, but the combination of required user interaction, local attack vector, and execution only in the context of the current (unprivileged) user caps real-world risk well below the headline 7.8 - this is a priority for environments that routinely open untrusted CBZ/archive files in PDF Architect, not a drop-everything issue. No SSVC decision data was supplied; absence of EPSS/KEV/POC is not an error but does mean spread cannot be quantified from the input.

An attacker crafts a malicious CBZ (comic book ZIP) file containing archive entries with directory-traversal path components and lures a PDF Architect user into opening it (e.g., via a download link or email attachment). When PDF Architect parses the CBZ without validating the user-supplied paths, files are written outside the intended extraction directory to an attacker-chosen location, leading to arbitrary code execution in the context of the current user. No public exploit code is identified in the provided data.