CVE-2025-14416: 
PDF Architect vulnerability analysis and mitigation

CVE-2025-14416 is a remote code execution vulnerability in pdfforge PDF Architect caused by insufficient UI warnings when processing DOC files. It was discovered by researcher kimiya and reported to ZDI on July 10, 2025. After the vendor failed to provide a patch, ZDI published it as a 0-day advisory on December 11, 2025, with CVE assignment following on December 23, 2025. The confirmed affected version is PDF Architect 9.1.74.23030. It carries a CVSS v3.0 base score of 7.0 (High) (ZDI Advisory).

The vulnerability is classified as CWE-356 (Product UI Does Not Warn User of Unsafe Actions). The flaw exists within PDF Architect's processing of DOC files, where the application permits the execution of dangerous scripts embedded in DOC files without presenting any warning to the user. An attacker can craft a malicious DOC file (or host it on a malicious web page) and, when the victim opens it in PDF Architect, arbitrary code executes silently in the context of the current user. The attack vector is local (the file must be opened on the victim's machine), requires no privileges, but does require user interaction (ZDI Advisory).

Successful exploitation grants an attacker full code execution in the context of the logged-in user, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker could read sensitive files, modify or delete data, install malware, or use the compromised user account as a foothold for lateral movement within a network. Because no elevated privileges are required to trigger the vulnerability, any user who opens a malicious DOC file in PDF Architect is at risk (ZDI Advisory).

This vulnerability was published as a 0-day advisory by ZDI on December 11, 2025, meaning no vendor patch existed at the time of public disclosure. The EPSS score is approximately 0.066% (low probability of near-term mass exploitation), and it does not appear in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported, and no specific threat actor attribution is available (ZDI Advisory).

1. Craft malicious DOC file: Create a DOC file embedding a dangerous macro or script payload designed to execute arbitrary commands when processed by PDF Architect.
2. Deliver the file: Distribute the malicious DOC file via phishing email, a malicious website, or a file-sharing platform, enticing the target to open it with PDF Architect.
3. Victim opens the file: The target opens the DOC file in PDF Architect version 9.1.74.23030 (or a similarly affected version).
4. Silent script execution: PDF Architect processes the DOC file and executes the embedded dangerous script without displaying any warning to the user.
5. Code execution achieved: The attacker's payload runs in the context of the current user, enabling actions such as dropping additional malware, establishing persistence, or exfiltrating data (ZDI Advisory).

• File System: Unexpected files created in user temp directories (e.g., %TEMP%, %APPDATA%) shortly after opening a DOC file in PDF Architect; presence of suspicious scripts or executables dropped by the PDF Architect process.
• Process: Unusual child processes spawned by the PDF Architect process (e.g., cmd.exe, powershell.exe, wscript.exe, mshta.exe) without user initiation.
• Network: Unexpected outbound network connections originating from the PDF Architect process to external IP addresses or domains following the opening of a DOC file.
• Logs: Windows Event Logs showing process creation events (Event ID 4688) with PDF Architect as the parent process launching scripting engines or shells.

As of the ZDI 0-day disclosure on December 11, 2025, pdfforge had not released a patch for this vulnerability. ZDI's recommended mitigation is to restrict interaction with PDF Architect, particularly avoiding opening DOC files from untrusted sources. Users should consider using alternative applications to open DOC files until an official patch is available. Organizations should apply application allowlisting or sandboxing controls around PDF Architect and monitor for suspicious child processes (ZDI Advisory).

The vulnerability was disclosed by ZDI researcher kimiya and published as a 0-day after pdfforge did not provide a fix within the coordinated disclosure window (reported July 10, 2025; published December 11, 2025 after multiple follow-ups). No notable public vendor statement, researcher commentary beyond the ZDI advisory, or significant social media discussion has been identified for this CVE (ZDI Advisory).