PDF Architect CVE-2026-92176

Exploitation requires the target to open a specially crafted PDF or visit a page that causes PDF Architect to parse attacker-controlled content - the CVSS vector's UI:R and AV:L encode exactly this delivery model (a local, file-driven attack reached through a user action), and no privileges or credentials are needed (PR:N). There is no indication that any server-side service, listening port, or remote API is involved, so an attacker cannot trigger this without the victim's interaction. Limiting factors: the flaw only affects the parsing path that handles App objects when such objects are present in the document, exploitation depends on the victim having an affected PDF Architect build installed and registered as the handler for the delivered file, and the practical exploit effort is higher while no public proof-of-concept exists. Version bounds are not confirmed by CPE, so defenders must confirm with pdfforge whether all releases prior to the fixed build are vulnerable.

The supplied CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) and the description are in tension: ZDI's prose says 'remote attackers', but the vector is AV:L with UI:R, which is the standard encoding for a file-format bug where the attacker delivers a malicious document and the victim must open it. That distinction matters operationally - this is not a wormable, unauthenticated network service flaw, and no CISA KEV listing, public exploit code, or EPSS score was provided, so there is no confirmed evidence of active exploitation at time of analysis. The technical impact of the memory corruption remains severe (full confidentiality, integrity, and availability loss within the user's process context), so even a mid-sized municipal IT team in walbrzych should treat it as urgent once a patched build is available, but it should not be triaged as an internet-facing emergency. Key gap: EPSS and KEV data absent, and the AV:L versus 'remote' wording conflict should be resolved against the ZDI advisory before using this score for prioritization.

An attacker crafts a PDF containing a malformed App object whose embedded data is shorter than the parser expects, then delivers it via email attachment, web download, or a page that auto-loads the document. The victim opens the file in an affected PDF Architect release, the parser reads past the end of the allocated buffer, and the resulting memory corruption is leveraged to execute code with the privileges of the logged-in user - no authentication to any service is required, only the file open. Because no public proof-of-concept or exploit code has been identified at time of analysis, an attacker would currently need to develop the exploit independently, which raises the effort required but does not eliminate the risk to unpatched endpoints.