PDF-XChange Editor PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-42076

Summary

A buffer overflow vulnerability exists within the PDF file parsing functionality of PDF-XChange Editor. The flaw arises from improper validation of the length of user-supplied data, which can allow remote attackers to execute arbitrary code by tricking users into opening specially crafted PDF files or visiting malicious web pages. When the affected software parses the malicious PDF, it may attempt to copy excessive data to a fixed-length heap-based buffer, resulting in the potential for remote code execution in the context of the current user session. Maintaining vigilance when handling PDF files from untrusted sources is crucial for users of this product.

References