PDF-XChange Editor Out-of-Bounds Write Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in PDF-XChange Editor versions 10.5.2.395 and prior. This issue arises from improper validation of user-supplied data when parsing U3D files, leading to a write past the end of an allocated object. As a result, remote attackers can execute arbitrary code on affected installations, but exploitation requires user interaction, such as opening a malicious file or visiting a harmful webpage.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, executed in the context of the current user.

Remediation

Users are advised to update to PDF-XChange Editor version 10.6.0.396, which addresses this vulnerability. This update can be downloaded from the PDF-XChange website or through the PDF-XChange Updater.