PDF-XChange Editor Out-of-Bounds Read Vulnerability Leading to Information Disclosure

A vulnerability allowing out-of-bounds read has been identified in PDF-XChange Editor, specifically in the way the application parses PDF files. This flaw arises from inadequate validation of user-supplied data, which can cause a read operation to extend beyond the end of an allocated object. As a result, remote attackers could exploit this vulnerability to disclose sensitive information on affected systems. User interaction is required, as the target must open a malicious PDF file or visit a harmful webpage. Additionally, this vulnerability could potentially be combined with others to execute arbitrary code within the current process context.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure. Furthermore, according to the Zero Day Initiative, this vulnerability could be leveraged, in conjunction with others, to execute arbitrary code in the context of the current process.

Remediation

Users are advised to update to PDF-XChange Editor version 10.4.2.390. For more information, consult the PDF-XChange security bulletins.