Information Disclosure Vulnerability in PDF-XChange Editor
CVE-2025-6649

3.3LOW

Key Information:

Vendor

PDF-xchange
Status
PDF-xchange Editor
Vendor
CVE Published:
25 June 2025

What is CVE-2025-6649?

An information disclosure vulnerability exists in PDF-XChange Editor due to improper validation of U3D file parsing. This flaw allows attackers to potentially gain access to sensitive information by requiring user interaction, such as opening a malicious file or visiting a harmful webpage. If exploited, this vulnerability can lead to unauthorized information being read from memory, which might be leveraged alongside other vulnerabilities to execute arbitrary code within the application’s context.

Affected Version(s)

PDF-XChange Editor 10.5.2.395

References

https://www.zerodayinitiative.com/advisories/ZDI-25-434/
x_research-advisory
https://www.pdf-xchange.com/support/security-bulletins.html
vendor-advisory

CVSS V3.0

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-6649 : Information Disclosure Vulnerability in PDF-XChange Editor