Remote Code Execution Vulnerability in PDF-XChange Editor Due to U3D File Parsing Flaw

CVE-2024-8817

Summary

A remote code execution vulnerability exists in PDF-XChange Editor due to insufficient validation of U3D file input. When a user opens a specially crafted U3D file or visits an attacker-controlled web page containing such a file, it can cause an out-of-bounds write, allowing an attacker to execute arbitrary code within the context of the application. The specific flaw occurs during the parsing of user-supplied U3D files, which may lead to manipulating the memory of the application, potentially compromising sensitive data and system integrity.

References