PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

An out-of-bounds read vulnerability allowing information disclosure has been identified in PDF-XChange Editor. This issue arises from improper validation of user-supplied data when parsing U3D files, leading to the potential for reading past the end of an allocated object. Remote attackers can exploit this vulnerability to disclose sensitive information on affected systems. User interaction is required, as the target must open a malicious U3D file or visit a compromised page. Additionally, this vulnerability could be leveraged alongside others to execute arbitrary code within the current process context.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure. Furthermore, according to the Zero Day Initiative, this vulnerability could be combined with others to execute arbitrary code in the context of the current process.

Remediation

Users are advised to update to PDF-XChange Editor version 10.5.0.393. For more information, consult the PDF-XChange security bulletins.