CVE-2026-92180: PDF Architect Privilege Escalation Flaw

CVE-2026-92180 Overview

CVE-2026-92180 is a local privilege escalation vulnerability in the activation-service component of pdfforge PDF Architect. The service loads a library from an unsecured filesystem location, allowing a local attacker with low-privileged code execution to plant a malicious library that runs in the context of SYSTEM. The issue is classified as an Uncontrolled Search Path Element weakness [CWE-427]. The Zero Day Initiative tracked this issue as ZDI-CAN-29536 and published advisory ZDI-26-615.

Critical Impact
A local, low-privileged attacker can gain SYSTEM-level code execution on hosts running PDF Architect's activation-service.

Affected Products

pdfforge PDF Architect
PDF Architect activation-service (Update Service component)
Windows installations of PDF Architect where the activation-service runs with SYSTEM privileges

Discovery Timeline

2026-09-15 - CVE-2026-92180 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92180

Vulnerability Analysis

The activation-service process in PDF Architect resolves a dependent library through an insecure search path. Windows searches for the library across several directories, and one of those locations is writable by non-privileged users. A local attacker can drop a malicious Dynamic Link Library (DLL) into that location, and the service loads it during startup or activation-related operations.

Because the service runs as SYSTEM, code inside the attacker-supplied DLL executes with full local privileges. The attack is local, requires only low privileges, and needs no user interaction, but its impact spans confidentiality, integrity, and availability.

Root Cause

The root cause is an Uncontrolled Search Path Element [CWE-427]. The service does not specify a fully qualified path when loading a dependent library and does not enforce a restricted DLL search order. As a result, Windows resolves the library from a directory an attacker can write to before falling back to a trusted system location.

Attack Vector

An attacker who already has an interactive or non-interactive foothold on the endpoint places a crafted DLL matching the name the service expects. When the activation-service starts, restarts, or otherwise triggers the library load, it maps the attacker-controlled DLL into a SYSTEM process. Common triggers include service restart, host reboot, or invocation of activation workflows by the product.

No verified public exploit code is available for CVE-2026-92180. See the Zero Day Initiative Advisory ZDI-26-615 for technical details.

Detection Methods for CVE-2026-92180

Indicators of Compromise

Unexpected DLL files appearing in the PDF Architect installation directory or in directories that fall within the activation-service's DLL search path
New or modified files in user-writable paths that match the name of libraries loaded by activation-service
SYSTEM-context child processes spawned by the PDF Architect activation-service that do not match known good baselines

Detection Strategies

Monitor image loads by the activation-service process and alert on modules loaded from non-standard or user-writable directories
Baseline the legitimate DLLs loaded by PDF Architect components and flag deviations, particularly unsigned modules
Correlate service start events with subsequent SYSTEM-level process creation for signs of hijacked execution flow

Monitoring Recommendations

Enable Sysmon Event ID 7 (Image Loaded) for PDF Architect service binaries and forward events to a central analytics pipeline
Audit filesystem write events (Sysmon Event ID 11) in the PDF Architect installation path and any directory it references
Track service configuration changes and unexpected restarts of the PDF Architect activation-service through Windows Event Log IDs 7036 and 7040

How to Mitigate CVE-2026-92180

Immediate Actions Required

Inventory endpoints running pdfforge PDF Architect and identify hosts where the activation-service runs as SYSTEM
Restrict write permissions on the PDF Architect installation directory and on any directory in the service's DLL search path to administrators only
Apply the principle of least privilege on affected hosts to limit which users can execute code locally

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-26-615 for vendor coordination status and any updated fix guidance. Apply pdfforge's official patch for PDF Architect as soon as it is released and verify that the activation-service loads libraries only from trusted, ACL-protected paths after the update.

Workarounds

Tighten NTFS access control lists on the PDF Architect installation directory to deny write access for standard users
Disable or stop the PDF Architect activation-service on hosts where activation functionality is not required until a patch is applied
Deploy application control policies (for example, Windows Defender Application Control or AppLocker) to block unsigned or unexpected DLLs from loading into PDF Architect processes

bash

# Configuration example: audit and restrict the PDF Architect install directory (run as Administrator)
icacls "C:\Program Files\PDF Architect" /inheritance:r
icacls "C:\Program Files\PDF Architect" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"

# Optional: stop the activation-service until a patch is applied
sc.exe stop "PDF Architect Activation Service"
sc.exe config "PDF Architect Activation Service" start= disabled