PDF-XChange Editor Use-After-Free Vulnerability in U3D File Parsing Allowing Information Disclosure

A use-after-free vulnerability has been identified in PDF-XChange Editor, specifically in versions through 10.5.2.395. This vulnerability arises from improper validation of objects during the parsing of U3D files, allowing remote attackers to access sensitive information. Exploitation requires user interaction, as the target must open a malicious U3D file or visit a harmful webpage. The flaw could potentially be combined with other vulnerabilities to execute arbitrary code within the current process context.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure and potentially allow for arbitrary code execution in the context of the affected process.

Remediation

Users are advised to update to PDF-XChange Editor version 10.6.0.396, which addresses this vulnerability. This update can be downloaded from the PDF-XChange website or through the PDF-XChange Updater.