Pdf Architect
Monthly
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted PDF or visits a malicious page. The flaw is a user-interaction-dependent memory-safety bug (CWE-125) driven by missing validation of user-supplied data, reported through the Zero Day Initiative as ZDI-CAN-28570. No public exploit code and no CISA KEV listing are present in the available intelligence, and EPSS data was not supplied, so the current risk is driven mainly by the 7.8 CVSS base score and the file-parsing attack surface rather than by observed in-the-wild activity.
Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF parsing logic, allowing a remote attacker to run arbitrary code in the context of the current process. Exploitation is client-side: the victim must open a malicious document or visit a page that delivers one, so an attacker must first convince the user to interact with the file. The flaw carries a CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787) and was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-28673 / ZDI-26-612; no KEV listing or public exploit indicator was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the context of the current process when a victim opens a crafted PDF or loads one from a malicious page. The vendor CPE (pdfforge:pdf_architect:*) gives no version boundaries, so all released builds are presumed affected until a fixed release appears. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-28916, advisory ZDI-26-613); at time of analysis there is no CISA KEV entry and no public exploit code identified, and exploitation is gated by the requirement that a user open the malicious document.
Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document in pdfforge PDF Architect, where the PDF parser writes past the end of an allocated buffer (CWE-787). Exploitation requires user interaction - the victim must open the malicious PDF or visit a page that triggers PDF rendering - but needs no prior privileges, and any resulting code runs with the privileges of the PDF Architect process. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-29219 / ZDI-26-614); no public exploit code or CISA KEV listing was present in the supplied intelligence, and no vendor fix version is confirmed in the available data.
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution on a Windows host to hijack a library loaded by the product's activation-service (Update Service) process and run code as SYSTEM. The flaw is an uncontrolled search path element (CWE-427) in which the service resolves a DLL from a location an unprivileged user can write to, so no remote vector or user interaction is required once the foothold exists. It was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-29536 / ZDI-26-615; no public exploit code, EPSS telemetry, or CISA KEV entry is present in the supplied data.
An out-of-bounds read in pdfforge PDF Architect's PDF parsing routine (confirmed affected build 9.1.74.23030) allows an attacker who supplies a crafted PDF to disclose sensitive contents of process memory. Exploitation is not remote or interaction-free: the victim must open the malicious document or visit a page that causes PDF Architect to render it (UI:R), and the assessed vector is local (AV:L) with no privileges required (PR:N). Standalone impact is confidentiality-only - arbitrary code execution in the context of the current process is only achievable by chaining this bug with a separate vulnerability. Risk in practice is low: EPSS is 0.18% (7th percentile), the issue is not in CISA KEV, and no public exploit code was identified at time of analysis.
Directory traversal in pdfforge PDF Architect 9.1.74.23030 allows unauthenticated attackers to execute arbitrary code by crafting a malicious CBZ archive that writes files outside the intended extraction directory. Exploitation requires the victim to open the crafted file (UI:R) and is limited to a local attack vector (AV:L), with code running at the current user's privileges. No public exploit code or active exploitation has been identified at time of analysis.
Memory corruption during PDF file parsing in pdfforge PDF Architect (confirmed affected build 9.1.74.23030) allows an attacker to execute arbitrary code in the context of the user who opens a crafted PDF, yielding high confidentiality, integrity, and availability impact for that process. The decisive limiting factor is the mandatory user interaction combined with a local attack vector: exploitation requires the target to open a malicious document (or visit a page that delivers one), and there is no remote network-service exposure, with code running only at the privileges of the invoking user. No public exploit code and no confirmed active exploitation were identified at time of analysis; the risk is conditional but real, and the vendor/ZDI advisory (ZDI-25-1076) is the primary reference.
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when the application processes a crafted XLS file and runs dangerous embedded script without presenting the user a warning prompt (CWE-356). An attacker must convince a target to open a malicious XLS file - or visit a page that serves one - after which code executes in the context of the current user; the LOCAL attack vector, mandatory user interaction (UI:R), and HIGH attack complexity (AC:H) confine this to targeted file-delivery scenarios rather than broad remote exploitation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the 7.0 score reflects high confidentiality, integrity, and availability impact gated behind user action and attacker-uncontrolled preconditions.
PDF Architect version 9.1.74.23030 executes embedded PDF Launch actions without first warning the user, so a crafted document can run arbitrary script in the victim's security context when opened. The flaw is local and requires user interaction, and no public exploit code has been identified at time of analysis; successful exploitation gives the attacker the same privileges as the current user.
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when a user opens a crafted DOC file, because the application executes dangerous embedded script without presenting a security warning (CWE-356). This is a moderate-risk client-side flaw requiring user interaction and high-complexity conditions, with code running only at the current user's privilege level; no public exploit identified at time of analysis and no CISA KEV entry is available.
Memory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted PDF or visits a malicious page. The flaw is a user-interaction-dependent memory-safety bug (CWE-125) driven by missing validation of user-supplied data, reported through the Zero Day Initiative as ZDI-CAN-28570. No public exploit code and no CISA KEV listing are present in the available intelligence, and EPSS data was not supplied, so the current risk is driven mainly by the 7.8 CVSS base score and the file-parsing attack surface rather than by observed in-the-wild activity.
Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF parsing logic, allowing a remote attacker to run arbitrary code in the context of the current process. Exploitation is client-side: the victim must open a malicious document or visit a page that delivers one, so an attacker must first convince the user to interact with the file. The flaw carries a CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787) and was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-28673 / ZDI-26-612; no KEV listing or public exploit indicator was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the context of the current process when a victim opens a crafted PDF or loads one from a malicious page. The vendor CPE (pdfforge:pdf_architect:*) gives no version boundaries, so all released builds are presumed affected until a fixed release appears. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-28916, advisory ZDI-26-613); at time of analysis there is no CISA KEV entry and no public exploit code identified, and exploitation is gated by the requirement that a user open the malicious document.
Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document in pdfforge PDF Architect, where the PDF parser writes past the end of an allocated buffer (CWE-787). Exploitation requires user interaction - the victim must open the malicious PDF or visit a page that triggers PDF rendering - but needs no prior privileges, and any resulting code runs with the privileges of the PDF Architect process. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-29219 / ZDI-26-614); no public exploit code or CISA KEV listing was present in the supplied intelligence, and no vendor fix version is confirmed in the available data.
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution on a Windows host to hijack a library loaded by the product's activation-service (Update Service) process and run code as SYSTEM. The flaw is an uncontrolled search path element (CWE-427) in which the service resolves a DLL from a location an unprivileged user can write to, so no remote vector or user interaction is required once the foothold exists. It was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-29536 / ZDI-26-615; no public exploit code, EPSS telemetry, or CISA KEV entry is present in the supplied data.
An out-of-bounds read in pdfforge PDF Architect's PDF parsing routine (confirmed affected build 9.1.74.23030) allows an attacker who supplies a crafted PDF to disclose sensitive contents of process memory. Exploitation is not remote or interaction-free: the victim must open the malicious document or visit a page that causes PDF Architect to render it (UI:R), and the assessed vector is local (AV:L) with no privileges required (PR:N). Standalone impact is confidentiality-only - arbitrary code execution in the context of the current process is only achievable by chaining this bug with a separate vulnerability. Risk in practice is low: EPSS is 0.18% (7th percentile), the issue is not in CISA KEV, and no public exploit code was identified at time of analysis.
Directory traversal in pdfforge PDF Architect 9.1.74.23030 allows unauthenticated attackers to execute arbitrary code by crafting a malicious CBZ archive that writes files outside the intended extraction directory. Exploitation requires the victim to open the crafted file (UI:R) and is limited to a local attack vector (AV:L), with code running at the current user's privileges. No public exploit code or active exploitation has been identified at time of analysis.
Memory corruption during PDF file parsing in pdfforge PDF Architect (confirmed affected build 9.1.74.23030) allows an attacker to execute arbitrary code in the context of the user who opens a crafted PDF, yielding high confidentiality, integrity, and availability impact for that process. The decisive limiting factor is the mandatory user interaction combined with a local attack vector: exploitation requires the target to open a malicious document (or visit a page that delivers one), and there is no remote network-service exposure, with code running only at the privileges of the invoking user. No public exploit code and no confirmed active exploitation were identified at time of analysis; the risk is conditional but real, and the vendor/ZDI advisory (ZDI-25-1076) is the primary reference.
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when the application processes a crafted XLS file and runs dangerous embedded script without presenting the user a warning prompt (CWE-356). An attacker must convince a target to open a malicious XLS file - or visit a page that serves one - after which code executes in the context of the current user; the LOCAL attack vector, mandatory user interaction (UI:R), and HIGH attack complexity (AC:H) confine this to targeted file-delivery scenarios rather than broad remote exploitation. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the 7.0 score reflects high confidentiality, integrity, and availability impact gated behind user action and attacker-uncontrolled preconditions.
PDF Architect version 9.1.74.23030 executes embedded PDF Launch actions without first warning the user, so a crafted document can run arbitrary script in the victim's security context when opened. The flaw is local and requires user interaction, and no public exploit code has been identified at time of analysis; successful exploitation gives the attacker the same privileges as the current user.
Code execution in pdfforge PDF Architect 9.1.74.23030 occurs when a user opens a crafted DOC file, because the application executes dangerous embedded script without presenting a security warning (CWE-356). This is a moderate-risk client-side flaw requiring user interaction and high-complexity conditions, with code running only at the current user's privilege level; no public exploit identified at time of analysis and no CISA KEV entry is available.
Memory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.