Use-After-Free Vulnerability in PDF-XChange Editor from Tracker Software
CVE-2025-6640

7.8HIGH

Key Information:

Vendor

PDF-xchange
Status
PDF-xchange Editor
Vendor
CVE Published:
25 June 2025

What is CVE-2025-6640?

A vulnerability exists within the PDF-XChange Editor related to the parsing of U3D files, allowing remote code execution. The flaw occurs due to insufficient validation of object existence before operations are conducted on it. This enables attackers to execute arbitrary code within the context of the current process, provided the target user interacts with a malicious web page or file. Users are urged to ensure their software is updated to mitigate this risk.

Affected Version(s)

PDF-XChange Editor 10.5.2.395

References

https://www.zerodayinitiative.com/advisories/ZDI-25-425/
x_research-advisory
https://www.pdf-xchange.com/support/security-bulletins.html
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-6640 : Use-After-Free Vulnerability in PDF-XChange Editor from Tracker Software