CVE-2026-92176

Received Received - Intake

Out-of-Bounds Read in PDF Architect App Object

Publication date: 2026-09-15

Last updated on: 2026-09-16

Assigner: Zero Day Initiative

Description

pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28570.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-16

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-92176

EUVD

EUVD-2026-79139

Affected Vendors & Products

Vendor	Product	Version / Range
pdfforge	pdf_architect	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in pdfforge PDF Architect that allows remote attackers to execute arbitrary code. It occurs due to improper validation of user-supplied data when handling App objects, leading to a read past the end of an allocated buffer. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file.

Detection Guidance

Detection of this vulnerability requires identifying the presence of pdfforge PDF Architect on your system. Check installed applications for PDF Architect and verify the version. If vulnerable, restrict user interaction with the application and monitor for suspicious activity such as unexpected file openings or network connections.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code on your system with the same privileges as the current user. If exploited, it could lead to unauthorized access, data theft, or system compromise. The impact includes high risks to confidentiality, integrity, and availability of data.

Compliance Impact

This vulnerability could lead to data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using the affected software may face legal penalties, reputational damage, and loss of trust due to unauthorized data access or exposure.

Mitigation Strategies

Restrict interaction with the vulnerable pdfforge PDF Architect product. Avoid opening untrusted files or visiting suspicious pages that may trigger the vulnerability.

Hi! I’m here to help you understand CVE-2026-92176. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70