PDF-XChange Editor Out-of-Bounds Read Vulnerability in XPS File Parsing Allowing Information Disclosure

An out-of-bounds read vulnerability has been identified in PDF-XChange Editor, specifically within the XPS file parsing component. This flaw arises from inadequate validation of user-supplied data, leading to the potential for reading past the end of an allocated object. As a result, remote attackers could exploit this vulnerability to disclose sensitive information on affected installations. User interaction is required, as the target must open a malicious XPS file. Additionally, this vulnerability could be leveraged, in conjunction with others, to execute arbitrary code within the context of the current process.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure and potentially allow for arbitrary code execution, according to the Zero Day Initiative.

Remediation

This vulnerability has been fixed in PDF-XChange Editor version 10.5.0.393.