CVE-2026-92176

CVE-2026-92176 is an out-of-bounds read (CWE-125) in how pdfforge PDF Architect handles App objects, caused by improper validation of user-supplied data that allows a read past the end of an allocated buffer. The flaw is triggered when a victim opens a malicious PDF file or visits a malicious page that feeds crafted content to the application, making user interaction a prerequisite. A successful exploit lets a remote attacker execute arbitrary code in the context of the current process, potentially gaining the privileges of the logged-in user. Anyone running an affected build of the Windows desktop PDF editor PDF Architect is exposed, particularly users who routinely open PDFs from untrusted sources. The bug was coordinated through Trend Micro's Zero Day Initiative (ZDI-CAN-28570); it is not in CISA's KEV catalog and no public proof-of-concept is known, so there is no evidence of in-the-wild exploitation.

What to do: Update PDF Architect to the newest release as soon as pdfforge ships a fix — confirm the patched version against the ZDI advisory, since the affected range was not stated in this data. Until then, warn users not to open unsolicited PDFs or follow links that auto-launch PDF Architect, and consider opening untrusted documents in a sandboxed or isolated viewer. IT teams should inventory endpoints for PDF Architect installs and prioritize patching machines used for handling external documents.