PDF-XChange Editor Out-Of-Bounds Read Vulnerability in PRC File Parsing Allowing Information Disclosure

A vulnerability allowing out-of-bounds read has been identified in PDF-XChange Editor versions 10.5.2.395 and prior, as well as in version 10.4.4.392. This issue arises from improper validation of user-supplied data when parsing PRC files, leading to the potential for reading past the end of an allocated object. Exploitation of this vulnerability requires user interaction, such as opening a malicious PRC file or visiting a harmful webpage. Additionally, this vulnerability could be leveraged alongside others to execute arbitrary code within the current process context.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure and potentially allow for arbitrary code execution, according to the Zero Day Initiative.

Remediation

Users are advised to update to PDF-XChange Editor version 10.6.0.396 or later, where this vulnerability has been addressed.