pdfforge PDF Architect CVE-2026-92179

Exploitation requires the target to have pdfforge PDF Architect installed on Windows and to open a maliciously crafted PDF file or visit a page that causes the product to parse one - the CVSS vector's UI:R reflects that mandatory user action, and AV:L reflects that the attacker must deliver a file to the victim rather than reach a network-exposed service. No authentication or elevated privileges are required (PR:N), and the resulting code executes in the context of the process that opens the document (user-level, not SYSTEM). Limiting factors: the attack is not remotely triggerable without victim interaction, there is no listening service to attack directly, and execution is confined to the PDF Architect process privileges - so impact depends on that user's rights. Exploitation is also contingent on the parser reaching the vulnerable code path with the crafted object structure, which means the file must be delivered intact (archives that mangle the PDF, or gateways that strip or sanitize attachments, will break the attack).

The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with a document-parsing bug: the AV:L metric reflects that the attacker delivers a file rather than touching a network service, AC:L reflects that no special preconditions beyond the crafted file are needed, PR:N means no authentication is required on the target, and UI:R captures the mandatory victim action of opening the PDF. The optimistic reading is that exploitation is fully automatable once a file is opened - the write primitive itself requires no timing races or unusual configuration. The pessimistic reading is that the attack surface is a desktop application, so mass exploitation requires social engineering rather than a wormable service exploit, and EPSS/KEV/POC signals were absent from the supplied data, meaning real-world exploitation is unproven here. This is a genuine post-opening code-execution risk for users of the product rather than a perimeter-emergency, and priority should be driven by whether PDF Architect is installed on high-value endpoints. Note explicitly: no KEV entry, no EPSS score, and no exploit-availability data were provided, so exploitation status is 'no public exploit identified at time of analysis' by default rather than confirmed quiet.

An attacker emails or hosts a crafted PDF whose malformed structure overflows a buffer when parsed, and social-engineers the victim into opening it or loading a page that embeds it. Upon opening, PDF Architect's parser overruns the allocation and the corrupted memory is leveraged to execute attacker code with the victim user's privileges - no elevation or credentials required, only the single user interaction. A public PoC is not identified in the supplied data, but the low complexity of the write primitive makes independent exploit development plausible once the advisory detail is public.