Out-Of-Bounds Write Vulnerability in PDF-XChange Editor by Tracker Software Products
CVE-2025-0910

8.8HIGH

Key Information:

Vendor
PDF-xchange
Status
PDF-xchange Editor
Vendor
CVE Published:
11 February 2025

Summary

The vulnerability in PDF-XChange Editor arises from the parsing of U3D files, where the application fails to properly validate user-supplied data. This oversight can allow attackers to execute arbitrary code by causing the application to write past the end of an allocated object. Successful exploitation requires user interaction, such as visiting a malicious page or opening a crafted file, enabling the attacker to leverage the flaw in the context of the current process.

Affected Version(s)

PDF-XChange Editor 10.4.3.391

References

https://www.zerodayinitiative.com/advisories/ZDI-25-065/
x_research-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.