Remote Code Execution Vulnerability in PDF-XChange Editor Affects User Security
CVE-2025-6644

7.8HIGH

Key Information:

Vendor

PDF-xchange
Status
PDF-xchange Editor
Vendor
CVE Published:
25 June 2025

What is CVE-2025-6644?

A vulnerability exists within the PDF-XChange Editor due to improper handling of U3D file parsing, allowing remote attackers to execute arbitrary code. The flaw is caused by the failure to validate the existence of an object before performing operations on it. Attackers must entice users to visit a malicious webpage or open a compromised file to exploit this vulnerability, potentially compromising user systems.

Affected Version(s)

PDF-XChange Editor 10.5.2.395

References

https://www.zerodayinitiative.com/advisories/ZDI-25-429/
x_research-advisory
https://www.pdf-xchange.com/support/security-bulletins.html
vendor-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-6644 : Remote Code Execution Vulnerability in PDF-XChange Editor Affects User Security