EUVD-2026-79138
GHSA-j93j-cv94-7497
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (zdi) · only source for this CVE.
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28673.
AnalysisAI
Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF parsing logic, allowing a remote attacker to run arbitrary code in the context of the current process. Exploitation is client-side: the victim must open a malicious document or visit a page that delivers one, so an attacker must first convince the user to interact with the file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pdf Architect
View allMemory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows remote attackers to caus
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary cod
Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the co
Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document i
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today