PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

An out-of-bounds read vulnerability allowing information disclosure has been identified in PDF-XChange Editor. This issue arises from improper validation of user-supplied data when parsing U3D files, leading to a read past the end of an allocated buffer. Remote attackers can exploit this vulnerability to disclose sensitive information on affected installations. User interaction is required, as the target must open a malicious U3D file or visit a harmful webpage. Additionally, this vulnerability could be leveraged, in conjunction with others, to execute arbitrary code within the current process context.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure, with the potential for arbitrary code execution in the context of the affected process.

Remediation

Users can upgrade to PDF-XChange Editor version 10.4.2.390 to address this vulnerability.