EUVD-2026-79139
GHSA-98j8-7g3r-r3x4
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-delivered parser bug requiring the victim to open a crafted PDF, so AV:L and UI:R with PR:N; full confidentiality, integrity and availability impact.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28570.
AnalysisAI
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted PDF or visits a malicious page. The flaw is a user-interaction-dependent memory-safety bug (CWE-125) driven by missing validation of user-supplied data, reported through the Zero Day Initiative as ZDI-CAN-28570. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to open a specially crafted PDF or visit a page that causes PDF Architect to parse attacker-controlled content - the CVSS vector's UI:R and AV:L encode exactly this delivery model (a local, file-driven attack reached through a user action), and no privileges or credentials are needed (PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) and the description are in tension: ZDI's prose says 'remote attackers', but the vector is AV:L with UI:R, which is the standard encoding for a file-format bug where the attacker delivers a malicious document and the victim must open it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | There is no vendor-released patch version identifiable from the supplied data - the only reference is the ZDI advisory ZDI-26-611, so the first step is to consult that advisory and pdfforge's release notes for the fixed PDF Architect build and upgrade every endpoint to it; absent an exact version, treat 'Patch available per vendor advisory' as unverified until pdfforge confirms it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pdf Architect
View allMemory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows remote attackers to caus
Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF
Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the co
Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document i
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today