EUVD-2026-79137
GHSA-r6p8-rhx9-p3qx
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the context of the current process when a victim opens a crafted PDF or loads one from a malicious page. The vendor CPE (pdfforge:pdf_architect:*) gives no version boundaries, so all released builds are presumed affected until a fixed release appears. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-28916, advisory ZDI-26-613); at time of analysis there is no CISA KEV entry and no public exploit code identified, and exploitation is gated by the requirement that a user open the malicious document.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Pdf Architect gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (zdi) · only source for this CVE.
CVSS VectorVendor: zdi
DescriptionCVE.org
pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28916.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Pdf Architect
View allMemory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows remote attackers to caus
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary cod
Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF
Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document i
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution
Directory traversal in pdfforge PDF Architect 9.1.74.23030 allows unauthenticated attackers to execute arbitrary code by
Memory corruption during PDF file parsing in pdfforge PDF Architect (confirmed affected build 9.1.74.23030) allows an at
PDF Architect version 9.1.74.23030 executes embedded PDF Launch actions without first warning the user, so a crafted doc
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when the application processes a crafted XLS file and runs
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when a user opens a crafted DOC file, because the applicati
An out-of-bounds read in pdfforge PDF Architect's PDF parsing routine (confirmed affected build 9.1.74.23030) allows an
Exploit-DB