CVE-2026-92179

pdfforge PDF Architect contains an out-of-bounds write vulnerability in its PDF file parsing logic, caused by inadequate validation of user-supplied data, which allows a write past the end of an allocated buffer. Exploitation requires user interaction: the victim must either open a specially crafted PDF file or visit a malicious page, after which a remote attacker can execute arbitrary code in the context of the current process. Successful exploitation gives the attacker full control with the privileges of the logged-on user, making it a serious risk on workstations where PDFs from untrusted sources are routinely opened. All users of affected PDF Architect builds on Windows are potentially at risk; the specific affected version range was not stated in the advisory data, so the vendor and ZDI advisories should be consulted. The flaw was coordinated through Trend Micro's Zero Day Initiative as ZDI-CAN-29219; it is not listed in CISA's KEV catalog and no public proof-of-concept is known, so there is no evidence of in-the-wild exploitation at this time.

What to do: Update PDF Architect to the patched release as soon as pdfforge publishes the fix, checking the ZDI advisory (ZDI-CAN-29219) and pdfforge release notes for the specific fixed version. In the interim, instruct users to open PDFs only from trusted sources and to disable automatic rendering of embedded content; endpoint protections that block malicious PDF attachments (e.g., email gateway sandboxing) will reduce the user-interaction attack path.