PDF-XChange Editor Out-Of-Bounds Read Vulnerability in U3D File Parsing Allowing Information Disclosure

A vulnerability allowing out-of-bounds read has been identified in PDF-XChange Editor, specifically in versions through 10.5.2.395. This issue arises during the parsing of U3D files, where improper validation of user-supplied data can lead to reading past the end of an allocated object. As a result, remote attackers could exploit this vulnerability to disclose sensitive information. Furthermore, this flaw could be leveraged alongside other vulnerabilities to execute arbitrary code within the current process context. Exploitation requires user interaction, as the target must open a malicious U3D file or visit a page containing one.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure and potentially allow for arbitrary code execution, according to the Zero Day Initiative.

Remediation

Users are advised to update to PDF-XChange Editor version 10.6.0.396 or later, where this vulnerability has been addressed. Instructions for updating can be found on the PDF-XChange website.