Information Disclosure Risk in PDF-XChange Editor by Tracker Software Products
CVE-2025-0905

8.8HIGH

Key Information:

Vendor
PDF-xchange
Status
PDF-xchange Editor
Vendor
CVE Published:
11 February 2025

Summary

A vulnerability in PDF-XChange Editor allows remote attackers to exploit the JB2 file parsing process, leading to the disclosure of sensitive information. This flaw arises from insufficient validation of user-supplied data, enabling an attacker to read data beyond allocated memory boundaries. Successful exploitation requires user interaction, as the target must open a specially crafted file or visit a malicious website. Attackers may leverage this vulnerability in conjunction with others to compromise system security further.

Affected Version(s)

PDF-XChange Editor 10.4.0.388

References

https://www.zerodayinitiative.com/advisories/ZDI-25-067/
x_research-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.