EUVD-2026-79136
GHSA-rrmh-4hj3-m4mj
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack arrives as a file the victim must open, so AV:L and UI:R; no credentials needed (PR:N) and no special parsing preconditions (AC:L).
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29219.
AnalysisAI
Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document in pdfforge PDF Architect, where the PDF parser writes past the end of an allocated buffer (CWE-787). Exploitation requires user interaction - the victim must open the malicious PDF or visit a page that triggers PDF rendering - but needs no prior privileges, and any resulting code runs with the privileges of the PDF Architect process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to have pdfforge PDF Architect installed on Windows and to open a maliciously crafted PDF file or visit a page that causes the product to parse one - the CVSS vector's UI:R reflects that mandatory user action, and AV:L reflects that the attacker must deliver a file to the victim rather than reach a network-exposed service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.0 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with a document-parsing bug: the AV:L metric reflects that the attacker delivers a file rather than touching a network service, AC:L reflects that no special preconditions beyond the crafted file are needed, PR:N means no authentication is required on the target, and UI:R captures the mandatory victim action of opening the PDF. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version is identified in the supplied data, so the first action is to monitor the ZDI advisory (https://www.zerodayinitiative.com/advisories/ZDI-26-614/) and pdfforge's release channels for a patched build and the confirmed vulnerable version range, given the wildcard CPE. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pdf Architect
View allMemory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows remote attackers to caus
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary cod
Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF
Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the co
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today