CVE-2025-14421

A local privilege escalation vulnerability in the pdfforge PDF Architect activation-service Update Service due to an uncontrolled search path element. The activation-service process loads a library from an unsecured location. An attacker must first obtain the ability to execute low-privileged code on the target system.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to memory corruption during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds read during the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.

A vulnerability in pdfforge PDF Architect's CBZ file parsing involves lack of validation of a user-supplied path before file operations, enabling directory traversal. Exploitation requires user interaction (opening a malicious file or visiting a malicious page). It can lead to remote code execution in the context of the current user.

pdfforge PDF Architect contains a remote code execution vulnerability when processing XLS files. The flaw is due to insufficient UI warning before executing dangerous scripts, allowing an attacker to execute code in the context of the current user.

pdfforge PDF Architect contains a remote code execution vulnerability when processing DOC files. The flaw is due to insufficient UI warning before executing dangerous scripts, allowing an attacker to execute code in the context of the current user.