PDF-XChange Editor Out-of-Bounds Read Vulnerability in XPS File Parsing Allowing Information Disclosure

A vulnerability allowing out-of-bounds read has been identified in PDF-XChange Editor, specifically within the XPS file parsing process. This flaw arises from inadequate validation of user-supplied data, leading to the potential for reading past the end of an allocated object. As a result, remote attackers could exploit this vulnerability to disclose sensitive information on affected installations. User interaction is required, as the target must open a malicious XPS file or visit a harmful webpage. Furthermore, this vulnerability could be leveraged alongside others to execute arbitrary code within the current process context.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure. Additionally, according to the Zero Day Initiative, it could be combined with other vulnerabilities to execute arbitrary code in the context of the current process.

Remediation

Users are advised to update to PDF-XChange Editor version 10.4.2.390.