ZDI-26-614: Unpatched PDF Architect Out-of-Bounds Write Enables RCE — Detection and Mitigation Guide

---
title: PDF Architect Spawning Script or Shell Child Process
id: 3f8c1a92-7b4d-4e61-9a05-2c7d8e1f6b03
status: experimental
description: Detects pdfforge PDF Architect spawning command shells, script engines, or LOLBins — a strong indicator of successful exploitation of a document-parsing memory corruption flaw such as ZDI-26-614. Legitimate PDF editors do not launch cmd, PowerShell, mshta, wscript, or rundll32 as child processes.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-614/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\PDF Architect'
      - '\pdfarchitect'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; PDF Architect has no legitimate function that launches shells or script engines
level: high
---
title: PDF Architect Writing Executable Content to User-Writable Directories
id: 91d4e5b7-2c3a-4f08-b6d1-5e9a7c2d4f18
status: experimental
description: Detects the PDF Architect process writing PE files or script payloads to temp, AppData, or Downloads directories — consistent with a second-stage drop following exploitation of an out-of-bounds write in the PDF parser (ZDI-26-614).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-614/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|contains:
      - '\PDF Architect'
      - '\pdfarchitect'
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\ProgramData\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.bat'
      - '.cmd'
      - '.ps1'
      - '.vbs'
      - '.js'
      - '.jse'
      - '.hta'
  condition: selection_process and selection_path and selection_ext
falsepositives:
  - PDF Architect self-updater writing components to ProgramData — correlate with vendor update signatures and scheduled update windows
level: high
---
title: PDF Architect Outbound Network Connection
id: b2e7f3a1-6d9c-4a85-8e24-7f1b3c5d9a62
status: experimental
description: Detects the PDF Architect process initiating outbound network connections. While update checks are legitimate, unexpected connections — especially to rare external hosts or immediately following document open — may indicate payload retrieval after exploitation of ZDI-26-614.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-614/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - '\PDF Architect'
      - '\pdfarchitect'
    Initiated: 'true'
  filter_update:
    DestinationHostname|contains:
      - 'pdfforge.org'
      - 'pdfarchitect.org'
  condition: selection and not filter_update
falsepositives:
  - Cloud conversion or licensing features contacting third-party services — baseline approved destinations before enforcing
level: medium

// Hunt: PDF Architect exploitation indicators (ZDI-26-614)
// Chain: suspicious child processes, payload drops, and non-vendor network egress
let PdfProc = dynamic(["pdf architect", "pdfarchitect"]);
let Lolbins = dynamic(["cmd.exe","powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe"]);
let VendorDomains = dynamic(["pdfforge.org","pdfarchitect.org"]);
let SuspiciousChildren =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName has_any (PdfProc)
    | where FileName in~ (Lolbins)
    | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256;
let SuspiciousDrops =
    DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName has_any (PdfProc)
    | where FolderPath has_any ("\\Temp\\", "\\AppData\\Roaming\\", "\\Downloads\\", "\\ProgramData\\")
    | where FileName has_any (".exe",".dll",".scr",".ps1",".bat",".vbs",".js",".hta")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256;
let SuspiciousNet =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName has_any (PdfProc)
    | where not(RemoteUrl has_any (VendorDomains))
    | summarize Connections=count(), RemoteIPs=make_set(RemoteIP), RemoteURLs=make_set(RemoteUrl)
        by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h);
SuspiciousChildren
| union SuspiciousDrops
| order by TimeGenerated desc;
// Run SuspiciousNet separately to review egress baselines per device

-- ZDI-26-614: PDF Architect exposure and exploitation hunt
-- 1) Identify installed PDF Architect binaries (attack surface)
-- 2) Flag running PDF Architect processes with suspicious children
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)pdf.?architect'

-- Child-process check: run on endpoints where PDF Architect is present
SELECT Pid, Ppid, Name, Exe, CommandLine, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|certutil|bitsadmin)\.exe$'
  AND Ppid IN (
      SELECT Pid FROM pslist() WHERE Exe =~ '(?i)pdf.?architect'
  )

-- Persistence check: PDF Architect or dropped payloads in Run keys
SELECT Name, Data, Key
FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*', accessor='registry')
WHERE Data =~ '(?i)(pdf.?architect|appdata.*\.(exe|dll|ps1|bat))'

# ZDI-26-614: PDF Architect exposure inventory and temporary mitigation
# Run elevated. Default mode = audit only. Use -Remove or -Block for enforcement.
param(
    [switch]$Remove,
    [switch]$Block,
    [string]$ReportPath = "$env:ProgramData\Security\ZDI-26-614-Report.csv"
)

$results = @()

# --- Inventory: find installed PDF Architect via registry uninstall hives ---
$hives = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$installed = Get-ItemProperty $hives -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'PDF Architect' }

foreach ($app in $installed) {
    $results += [PSCustomObject]@{
        Hostname        = $env:COMPUTERNAME
        Product         = $app.DisplayName
        Version         = $app.DisplayVersion
        Publisher       = $app.Publisher
        InstallLocation = $app.InstallLocation
        UninstallString = $app.UninstallString
        Detected        = (Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
    }
}

if ($results.Count -gt 0) {
    New-Item -Path (Split-Path $ReportPath) -ItemType Directory -Force | Out-Null
    $results | Export-Csv -Path $ReportPath -NoTypeInformation -Append
    Write-Warning "PDF Architect detected. Report: $ReportPath"

    # --- Optional: uninstall as attack-surface reduction until patch ships ---
    if ($Remove) {
        foreach ($app in $installed) {
            if ($app.UninstallString) {
                Write-Host "Uninstalling: $($app.DisplayName)"
                $uninst = $app.UninstallString -replace '^MsiExec\.exe\s*/I', 'msiexec.exe /X'
                Start-Process cmd.exe -ArgumentList "/c $uninst /qn /norestart" -Wait
            }
        }
    }

    # --- Optional: block execution via Image File Execution Options debugger trick ---
    # (Emergency stopgap only; prefer AppLocker/WDAC publisher rules in managed fleets)
    if ($Block) {
        $exeNames = @('PDF Architect.exe','PDFArchitect.exe','pdfarchitect.exe')
        foreach ($exe in $exeNames) {
            $ifeo = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$exe"
            New-Item -Path $ifeo -Force | Out-Null
            New-ItemProperty -Path $ifeo -Name 'Debugger' -Value 'systray.exe' -PropertyType String -Force | Out-Null
            Write-Host "Execution blocked via IFEO: $exe"
        }
    }
} else {
    Write-Host "No PDF Architect installations found on $env:COMPUTERNAME."
}

# --- Verification: confirm no PDF Architect process is currently running ---
Get-Process | Where-Object { $_.Path -match 'PDF.?Architect' } |
    Select-Object Name, Id, Path, StartTime