PDF-XChange Editor Out-Of-Bounds Read Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in PDF-XChange Editor versions 10.5.2.395 and prior, as well as in version 10.0.0.370 and several other releases within the 9.x series. This vulnerability arises from improper validation of user-supplied data when parsing U3D files, leading to an out-of-bounds read that can be exploited to execute arbitrary code in the context of the current process. Exploitation requires user interaction, such as opening a malicious file or visiting a harmful webpage.

Impact

Successful exploitation allows remote attackers to execute arbitrary code on the affected system.

Remediation

Users are advised to update to PDF-XChange Editor version 10.6.0.396 or later. This update addresses the vulnerability by improving the validation of U3D files, preventing the out-of-bounds read that could be exploited for code execution.