Threat Intelligence Database

pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28570.

CVE-2026-92177 is a high-severity vulnerability in pdfforge PDF Architect version 9.1.83.23106. It involves an out-of-bounds write during PDF file parsing, which can lead to remote code execution if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data, allowing writes beyond allocated memory.

CVE-2026-92179 is a high-severity vulnerability in pdfforge PDF Architect version 9.1.83.23106. It is an out-of-bounds write flaw in the PDF file parsing component that can lead to remote code execution. Exploitation requires user interaction, such as opening a malicious PDF file or visiting a malicious page. The vulnerability arises from improper validation of user-supplied data, allowing writes beyond allocated buffer boundaries. This can enable attackers to execute arbitrary code with the privileges of the current process.

CVE-2026-92180 is a local privilege escalation vulnerability in pdfforge PDF Architect version 9.1.90.23122. The flaw exists in the activation-service process, which loads a library from an unsecured location, allowing a local attacker with low privileges to escalate to SYSTEM level. Exploitation requires prior ability to execute low-privileged code on the target system. The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element) and has a high severity with a CVSS score of 7.8.