Out-Of-Bounds Read Vulnerability in PDF-XChange Editor by Tracker Software Products
CVE-2025-6658

3.3LOW

Key Information:

Vendor

PDF-xchange
Status
PDF-xchange Editor
Vendor
CVE Published:
25 June 2025

What is CVE-2025-6658?

An information disclosure vulnerability exists in PDF-XChange Editor when parsing PRC files. This issue arises due to inadequate validation of user-supplied data, potentially allowing remote attackers to read past the end of an allocated buffer. Successful exploitation requires user interaction, as attendees must visit a malicious webpage or open a specially crafted file. Attackers may leverage this vulnerability alongside other weaknesses to execute arbitrary code within the context of the current process, posing serious risks to data integrity.

Affected Version(s)

PDF-XChange Editor 10.5.2.395

References

https://www.zerodayinitiative.com/advisories/ZDI-25-444/
x_research-advisory
https://www.pdf-xchange.com/support/security-bulletins.html
vendor-advisory

CVSS V3.0

Score:
3.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-6658 : Out-Of-Bounds Read Vulnerability in PDF-XChange Editor by Tracker Software Products