pdfforge PDF Architect CVE-2025-14421

Exploitation requires the victim to open an attacker-crafted PDF file or visit a malicious page that is processed by pdfforge PDF Architect (confirmed affected build 9.1.74.23030); the flaw is triggered during the PDF file-parsing routine when user-supplied data is not validated before a read. Key limiting factors: mandatory user interaction (UI:R - the file must be opened/rendered by the target) and a local attack vector (AV:L), meaning there is no remote, interaction-free path. No special product configuration or non-default feature is required beyond having PDF Architect open the malicious document. Standalone impact is limited to information disclosure; arbitrary code execution requires chaining with a separate vulnerability.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 base score of 5.5 reflects a local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R), with impact limited to confidentiality (C:H/I:N/A:N) - consistent with an out-of-bounds read (CWE-125) that discloses process memory rather than corrupting it. Exploitation signals are weak and mutually consistent: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, so this is a high-attention-from-ZDI but low-real-world-risk finding rather than an active threat. The one caveat is the ZDI/tag framing versus the technical core: the tags and advisory note that the OOB read can be chained 'in conjunction with other vulnerabilities to execute arbitrary code,' but by itself this CVE is an information-disclosure primitive, not code execution - the RCE/Buffer Overflow tags overstate the standalone impact. No key CVSS data is missing or internally conflicting; the vector (local, UI-required) aligns with the description (victim must open a malicious file or visit a malicious page).

An attacker crafts a malicious PDF and lures a PDF Architect user into opening it (e.g., via email attachment or a link to a malicious page). When the vulnerable parser processes the file, it reads past the end of an allocated object and leaks adjacent process memory, potentially exposing sensitive data; a motivated attacker could combine this leak with a separate memory-corruption bug to achieve code execution. No public exploit code was identified at time of analysis.