Description
pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29219.
Published: 2026-09-15
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

An out‑of‑bounds write in PDF Architect opens a specially crafted PDF document or visits a malicious site that forces the application to parse a received file. The flaw arises from insufficient validation of PDF data, enabling an attacker to overwrite memory and run arbitrary code in the context of the running process.

Affected Systems

The vulnerability affects all installations of pdfforge PDF Architect; no specific product version was disclosed in the advisory.

Risk and Exploitability

The CVSS score of 7.8, and the exploit requires user interaction such as opening a malicious PDF or visiting a site that delivers a malicious file. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The need for user action still poses a significant risk for environments where users handle PDF files.

Generated by OpenCVE AI on September 20, 2026 at 14:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any available patch for PDF Architect to address the buffer overflow flaw.
  • Disable automatic opening of PDFs from untrusted or unknown sources, and require user confirmation before opening any PDF file.
  • Run PDF Architect with the least privilege or within a sandboxed environment to limit damage from potential exploitation.

Generated by OpenCVE AI on September 20, 2026 at 14:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Pdfforge
Pdfforge pdf Architect
Vendors & Products Pdfforge
Pdfforge pdf Architect

Tue, 15 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Description pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29219.
Title pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Weaknesses CWE-787
References
Metrics cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Pdfforge Pdf Architect
cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published:

Updated: 2026-09-16T03:57:31.117Z

Reserved: 2026-09-15T18:05:00.804Z

Link: CVE-2026-92179

cve-icon Vulnrichment

Updated: 2026-09-15T19:23:45.571Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T19:17:48.367

Modified: 2026-09-16T20:26:50.280

Link: CVE-2026-92179

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T14:30:18Z

Weaknesses