CVE-2025-14418

A local privilege escalation vulnerability in the pdfforge PDF Architect activation-service Update Service due to an uncontrolled search path element. The activation-service process loads a library from an unsecured location. An attacker must first obtain the ability to execute low-privileged code on the target system.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to memory corruption during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds read during the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.

pdfforge PDF Architect contains an out-of-bounds read during PDF parsing due to lack of proper validation of user-supplied data. A remote attacker can disclose sensitive information and, combined with other vulnerabilities, execute arbitrary code in the context of the current process; user interaction (opening a malicious file or page) is required.

A vulnerability in pdfforge PDF Architect's CBZ file parsing involves lack of validation of a user-supplied path before file operations, enabling directory traversal. Exploitation requires user interaction (opening a malicious file or visiting a malicious page). It can lead to remote code execution in the context of the current user.

pdfforge PDF Architect contains a remote code execution vulnerability when processing DOC files. The flaw is due to insufficient UI warning before executing dangerous scripts, allowing an attacker to execute code in the context of the current user.