CVE-2026-92176
HighCVSS 7.8Summary
A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds read during the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.
Risk Assessment
A remote attacker can execute arbitrary code in the context of the current process, potentially leading to system compromise. This requires the user to open a malicious PDF or visit a malicious page.
Recommendation
Update pdfforge PDF Architect to a version containing the fix. Avoid opening untrusted PDF files and visiting suspicious pages.
Other vulnerabilities in pdfforge PDF Architect
See all- CVE-2026-92180High
A local privilege escalation vulnerability in the pdfforge PDF Architect activation-service Update Service due to an uncontrolled search path element. The activation-service process loads a library from an unsecured location. An attacker must first obtain the ability to execute low-privileged code on the target system.
- CVE-2026-92179High
A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.
- CVE-2026-92178High
A remote code execution vulnerability in pdfforge PDF Architect due to memory corruption during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. User interaction is required: the target must visit a malicious page or open a malicious file.
- CVE-2026-92177High
A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. User interaction is required: the target must visit a malicious page or open a malicious file.
Original NVD description (English source)
pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28570.