Vulnerabilites related to pdf-xchange - pdf-xchange_editor
CVE-2018-18689 (GCVE-0-2018-18689)
Vulnerability from cvelistv5
Published
2021-01-07 17:59
Modified
2024-08-05 11:16
Severity ?
Summary
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.
References
https://www.foxitsoftware.com/support/security-bulletins.phpx_refsource_CONFIRM
https://pdf-insecurity.org/signature/evaluation_2018.htmlx_refsource_MISC
https://pdf-insecurity.org/signature/signature.htmlx_refsource_MISC
https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/x_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T11:16:00.394Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.foxitsoftware.com/support/security-bulletins.php",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pdf-insecurity.org/signature/evaluation_2018.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://pdf-insecurity.org/signature/signature.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-01-07T17:59:16",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.foxitsoftware.com/support/security-bulletins.php",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pdf-insecurity.org/signature/evaluation_2018.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://pdf-insecurity.org/signature/signature.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2018-18689",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.foxitsoftware.com/support/security-bulletins.php",
                     refsource: "CONFIRM",
                     url: "https://www.foxitsoftware.com/support/security-bulletins.php",
                  },
                  {
                     name: "https://pdf-insecurity.org/signature/evaluation_2018.html",
                     refsource: "MISC",
                     url: "https://pdf-insecurity.org/signature/evaluation_2018.html",
                  },
                  {
                     name: "https://pdf-insecurity.org/signature/signature.html",
                     refsource: "MISC",
                     url: "https://pdf-insecurity.org/signature/signature.html",
                  },
                  {
                     name: "https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/",
                     refsource: "MISC",
                     url: "https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-18689",
      datePublished: "2021-01-07T17:59:16",
      dateReserved: "2018-10-26T00:00:00",
      dateUpdated: "2024-08-05T11:16:00.394Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0911 (GCVE-0-2025-0911)
Vulnerability from cvelistv5
Published
2025-02-11 19:58
Modified
2025-02-12 15:36
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25957.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-066/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.4.392
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0911",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-11T20:27:03.362837Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T15:36:38.639Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.4.392",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:57.570Z",
         datePublic: "2025-01-31T22:07:27.768Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25957.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:58:33.626Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-066",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-066/",
            },
         ],
         source: {
            lang: "en",
            value: "Anonymous",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0911",
      datePublished: "2025-02-11T19:58:33.626Z",
      dateReserved: "2025-01-30T20:36:57.517Z",
      dateUpdated: "2025-02-12T15:36:38.639Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8842 (GCVE-0-2024-8842)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-25 19:16
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RTF files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24481.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1265/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8842",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:06:57.326001Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:16:23.883Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:48.186-05:00",
         datePublic: "2024-09-17T11:26:43.253-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of RTF files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24481.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-457",
                     description: "CWE-457: Use of Uninitialized Variable",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:21.546Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1265",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1265/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8842",
      datePublished: "2024-11-22T21:05:21.546Z",
      dateReserved: "2024-09-13T18:16:48.107Z",
      dateUpdated: "2024-11-25T19:16:23.883Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42387 (GCVE-0-2022-42387)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:52
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18656.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1378/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.314Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1378/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42387",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T18:49:42.425412Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:52:53.414Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18656.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1378/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42387",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:52:53.414Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42414 (GCVE-0-2022-42414)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:44
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18326.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1342/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.466Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1342/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42414",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:38:14.758124Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:44:57.053Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18326.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416: Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1342/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42414",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:44:57.053Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42419 (GCVE-0-2022-42419)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 17:38
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18700.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1389/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.909Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1389/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42419",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T17:38:41.986045Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T17:38:49.429Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18700.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1389/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42419",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T17:38:49.429Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42382 (GCVE-0-2022-42382)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:39
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18651.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1373/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.315Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1373/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42382",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:39:35.607790Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:39:44.620Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18651.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1373/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42382",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:39:44.620Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42416 (GCVE-0-2022-42416)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:44
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18673.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1385/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.873Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1385/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42416",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:38:25.975804Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:44:14.925Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18673.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1385/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42416",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:44:14.925Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42423 (GCVE-0-2022-42423)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 17:36
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18716.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1390/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.937Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1390/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42423",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T17:36:26.153611Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T17:36:37.075Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18716.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1390/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42423",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T17:36:37.075Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42413 (GCVE-0-2022-42413)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:45
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18368.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1358/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.440Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1358/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42413",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:38:05.421077Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:45:11.090Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18368.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1358/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42413",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:45:11.090Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42388 (GCVE-0-2022-42388)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:52
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18657.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1379/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.431Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1379/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42388",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T18:27:19.059372Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:52:41.433Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18657.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1379/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42388",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:52:41.433Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0904 (GCVE-0-2025-0904)
Vulnerability from cvelistv5
Published
2025-02-11 19:57
Modified
2025-02-12 14:28
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25422.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-071/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.0.388
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0904",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-12T14:28:14.111978Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T14:28:19.639Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.0.388",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:25.107Z",
         datePublic: "2025-01-31T22:08:40.655Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25422.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:57:11.371Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-071",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-071/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0904",
      datePublished: "2025-02-11T19:57:11.371Z",
      dateReserved: "2025-01-30T20:36:25.048Z",
      dateUpdated: "2025-02-12T14:28:19.639Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42389 (GCVE-0-2022-42389)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:52
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18658.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1380/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.188Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1380/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42389",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:45:12.516575Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:52:25.447Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18658.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1380/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42389",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:52:25.447Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37363 (GCVE-0-2022-37363)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:25
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17673.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1091/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.952Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1091/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37363",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:25:25.958698Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:25:36.616Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17673.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1091/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37363",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:25:36.616Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42405 (GCVE-0-2022-42405)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 18:41
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18367.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1357/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.375Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1357/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42405",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T18:41:41.417049Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T18:41:50.360Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18367.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-122",
                     description: "CWE-122: Heap-based Buffer Overflow",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1357/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42405",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T18:41:50.360Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37361 (GCVE-0-2022-37361)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:14
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17674.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1089/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.718Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1089/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37361",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:13:58.600502Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:14:03.338Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17674.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1089/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37361",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:14:03.338Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8848 (GCVE-0-2024-8848)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-22 21:29
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25268.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1271/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.1.387
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8848",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-22T21:29:35.444845Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-22T21:29:50.690Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.1.387",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:17:21.458-05:00",
         datePublic: "2024-09-17T11:27:30.551-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25268.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:45.608Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1271",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1271/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8848",
      datePublished: "2024-11-22T21:05:45.608Z",
      dateReserved: "2024-09-13T18:17:21.379Z",
      dateUpdated: "2024-11-22T21:29:50.690Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8829 (GCVE-0-2024-8829)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24314.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1252/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8829",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:47.725629Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:26.548Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:37.433-05:00",
         datePublic: "2024-09-17T11:25:13.339-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24314.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:23.820Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1252",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1252/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8829",
      datePublished: "2024-11-22T21:04:23.820Z",
      dateReserved: "2024-09-13T18:15:37.356Z",
      dateUpdated: "2024-11-23T01:26:26.548Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42381 (GCVE-0-2022-42381)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:40
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18650.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1372/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.318Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1372/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42381",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:39:57.592393Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:40:06.221Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18650.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1372/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42381",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:40:06.221Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42384 (GCVE-0-2022-42384)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:38
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18653.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1375/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.412Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1375/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42384",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:38:50.366796Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:38:57.806Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18653.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1375/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42384",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:38:57.806Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8834 (GCVE-0-2024-8834)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24319.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1257/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8834",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:36.239944Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:26.293Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:02.504-05:00",
         datePublic: "2024-09-17T11:25:48.073-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24319.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:45.547Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1257",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1257/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8834",
      datePublished: "2024-11-22T21:04:45.547Z",
      dateReserved: "2024-09-13T18:16:02.426Z",
      dateUpdated: "2024-11-23T01:26:26.293Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42418 (GCVE-0-2022-42418)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 17:39
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18677.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1387/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.881Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1387/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42418",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T17:39:33.519222Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T17:39:42.106Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18677.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-822",
                     description: "CWE-822: Untrusted Pointer Dereference",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1387/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42418",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T17:39:42.106Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37369 (GCVE-0-2022-37369)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:22
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17724.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1097/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.971Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1097/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37369",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:22:47.312873Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:22:51.504Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Anonymous",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17724.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1097/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37369",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:22:51.504Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42410 (GCVE-0-2022-42410)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:45
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PGM files. Crafted data in a PGM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18365.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1355/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.430Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1355/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42410",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:37:37.107087Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:45:56.865Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PGM files. Crafted data in a PGM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18365.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1355/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42410",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:45:56.865Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0906 (GCVE-0-2025-0906)
Vulnerability from cvelistv5
Published
2025-02-11 19:57
Modified
2025-02-12 14:27
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25434.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-068/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.0.388
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0906",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-12T14:27:30.540796Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T14:27:34.262Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.0.388",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:35.038Z",
         datePublic: "2025-01-31T22:08:08.641Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25434.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:57:41.221Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-068",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-068/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0906",
      datePublished: "2025-02-11T19:57:41.221Z",
      dateReserved: "2025-01-30T20:36:34.983Z",
      dateUpdated: "2025-02-12T14:27:34.262Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0901 (GCVE-0-2025-0901)
Vulnerability from cvelistv5
Published
2025-02-11 19:56
Modified
2025-02-12 14:29
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25372.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-062/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.0.388
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0901",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-12T14:29:26.191595Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T14:29:38.623Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.0.388",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:14.461Z",
         datePublic: "2025-01-31T22:06:24.159Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25372.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:56:31.557Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-062",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-062/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0901",
      datePublished: "2025-02-11T19:56:31.557Z",
      dateReserved: "2025-01-30T20:36:14.345Z",
      dateUpdated: "2025-02-12T14:29:38.623Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41148 (GCVE-0-2022-41148)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:35
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18338.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1345/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.409Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1345/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41148",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T14:35:19.976072Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:35:28.950Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18338.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1345/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41148",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:35:28.950Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41147 (GCVE-0-2022-41147)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:36
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18286.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1337/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.377Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1337/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41147",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T14:35:56.879652Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:36:05.968Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "khangkito - Tran Van Khang (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18286.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1337/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41147",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:36:05.968Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8835 (GCVE-0-2024-8835)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24320.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1258/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8835",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:30.365807Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:26.176Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:07.288-05:00",
         datePublic: "2024-09-17T11:25:54.524-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated  object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24320.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:52.471Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1258",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1258/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8835",
      datePublished: "2024-11-22T21:04:52.471Z",
      dateReserved: "2024-09-13T18:16:07.212Z",
      dateUpdated: "2024-11-23T01:26:26.176Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41152 (GCVE-0-2022-41152)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:25
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18342.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1349/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.431Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1349/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41152",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T14:25:26.116982Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:25:34.600Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18342.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1349/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41152",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:25:34.600Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42392 (GCVE-0-2022-42392)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:51
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18661.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1383/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.337Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1383/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42392",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:36:14.417885Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:51:33.600Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18661.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1383/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42392",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:51:33.600Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37350 (GCVE-0-2022-37350)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:13
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Collab objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17144.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1078/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.754Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1078/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37350",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:13:01.182246Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:13:43.098Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Suyue Guo and Wei You from Renmin University of China",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Collab objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17144.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1078/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37350",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:13:43.098Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37374 (GCVE-0-2022-37374)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 17:32
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18068.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1102/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.921Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1102/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37374",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T17:31:57.473380Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T17:32:13.308Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18068.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416: Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1102/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37374",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T17:32:13.308Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2019-17497 (GCVE-0-2019-17497)
Vulnerability from cvelistv5
Published
2019-10-10 23:52
Modified
2024-08-05 01:40
Severity ?
Summary
Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\192.168.0.2\C$\file.pdf without user interaction.
References
https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdfx_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T01:40:15.799Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdf",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\\\192.168.0.2\\C$\\file.pdf without user interaction.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-10-10T23:52:06",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdf",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2019-17497",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\\\192.168.0.2\\C$\\file.pdf without user interaction.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdf",
                     refsource: "MISC",
                     url: "https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdf",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2019-17497",
      datePublished: "2019-10-10T23:52:06",
      dateReserved: "2019-10-10T00:00:00",
      dateUpdated: "2024-08-05T01:40:15.799Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41151 (GCVE-0-2022-41151)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:26
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18341.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1348/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.563Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1348/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41151",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T14:25:54.266178Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:26:04.136Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18341.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1348/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41151",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:26:04.136Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2018-16303 (GCVE-0-2018-16303)
Vulnerability from cvelistv5
Published
2018-09-01 14:00
Modified
2024-08-05 10:17
Severity ?
Summary
PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564.
References
https://forum.tracker-software.com/viewtopic.php?f=62&t=31419x_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T10:17:38.408Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://forum.tracker-software.com/viewtopic.php?f=62&t=31419",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-09-01T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-09-01T14:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://forum.tracker-software.com/viewtopic.php?f=62&t=31419",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2018-16303",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://forum.tracker-software.com/viewtopic.php?f=62&t=31419",
                     refsource: "MISC",
                     url: "https://forum.tracker-software.com/viewtopic.php?f=62&t=31419",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-16303",
      datePublished: "2018-09-01T14:00:00",
      dateReserved: "2018-09-01T00:00:00",
      dateUpdated: "2024-08-05T10:17:38.408Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8820 (GCVE-0-2024-8820)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24215.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1243/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8820",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:19:23.946957Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:27.277Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:06.725-05:00",
         datePublic: "2024-09-17T11:24:08.238-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24215.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:49.109Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1243",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1243/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8820",
      datePublished: "2024-11-22T21:03:49.109Z",
      dateReserved: "2024-09-13T18:15:06.649Z",
      dateUpdated: "2024-11-23T01:26:27.277Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8819 (GCVE-0-2024-8819)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24214.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1242/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8819",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:19:29.522318Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:27.385Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:03.022-05:00",
         datePublic: "2024-09-17T11:24:01.420-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24214.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:45.157Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1242",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1242/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8819",
      datePublished: "2024-11-22T21:03:45.157Z",
      dateReserved: "2024-09-13T18:15:02.935Z",
      dateUpdated: "2024-11-23T01:26:27.385Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8844 (GCVE-0-2024-8844)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24550.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1267/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8844",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:17:59.532803Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:25.501Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:56.698-05:00",
         datePublic: "2024-09-17T11:26:56.209-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24550.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:29.187Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1267",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1267/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8844",
      datePublished: "2024-11-22T21:05:29.187Z",
      dateReserved: "2024-09-13T18:16:56.597Z",
      dateUpdated: "2024-11-23T01:26:25.501Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8849 (GCVE-0-2024-8849)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-22 21:28
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25269.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1272/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.1.387
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8849",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-22T21:27:44.714392Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-22T21:28:10.560Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.1.387",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:17:27.156-05:00",
         datePublic: "2024-09-17T11:27:39.775-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25269.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:49.917Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1272",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1272/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8849",
      datePublished: "2024-11-22T21:05:49.917Z",
      dateReserved: "2024-09-13T18:17:27.018Z",
      dateUpdated: "2024-11-22T21:28:10.560Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8823 (GCVE-0-2024-8823)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24261.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1246/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8823",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:19:06.061917Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:26.877Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:16.787-05:00",
         datePublic: "2024-09-17T11:24:28.660-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24261.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:00.356Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1246",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1246/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8823",
      datePublished: "2024-11-22T21:04:00.356Z",
      dateReserved: "2024-09-13T18:15:16.688Z",
      dateUpdated: "2024-11-23T01:26:26.877Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42373 (GCVE-0-2022-42373)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:45
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18402.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1360/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.316Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1360/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42373",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:45:17.598684Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:45:28.032Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18402.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1360/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42373",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:45:28.032Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42406 (GCVE-0-2022-42406)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:46
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18369.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1359/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.480Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1359/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42406",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:37:17.922833Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:46:59.938Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18369.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1359/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42406",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:46:59.938Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37370 (GCVE-0-2022-37370)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:24
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17725.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1098/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.938Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1098/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37370",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:23:25.826027Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:24:29.182Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Anonymous",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17725.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1098/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37370",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:24:29.182Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8841 (GCVE-0-2024-8841)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24432.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1264/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8841",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:12.688830Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:25.744Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:44.385-05:00",
         datePublic: "2024-09-17T11:26:36.021-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24432.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:18.077Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1264",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1264/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8841",
      datePublished: "2024-11-22T21:05:18.077Z",
      dateReserved: "2024-09-13T18:16:44.307Z",
      dateUpdated: "2024-11-23T01:26:25.744Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41153 (GCVE-0-2022-41153)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:48
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18343.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1350/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.329Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1350/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41153",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:48:52.249370Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:48:59.336Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18343.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1350/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41153",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:48:59.336Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8812 (GCVE-0-2024-8812)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-25 19:02
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24207.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1235/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8812",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:02:08.734838Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:02:14.901Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:14:30.695-05:00",
         datePublic: "2024-09-17T11:23:03.133-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24207.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:14.886Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1235",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1235/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8812",
      datePublished: "2024-11-22T21:03:14.886Z",
      dateReserved: "2024-09-13T18:14:30.605Z",
      dateUpdated: "2024-11-25T19:02:14.901Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37372 (GCVE-0-2022-37372)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:26
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17809.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1100/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.953Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1100/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37372",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:26:11.400219Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:26:16.231Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Anonymous",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17809.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1100/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37372",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:26:16.231Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-27323 (GCVE-0-2024-27323)
Vulnerability from cvelistv5
Published
2024-04-01 21:48
Modified
2024-08-02 00:34
Severity ?
7.5 (High) - CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this vulnerability. The specific flaw exists within the update functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22224.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-198/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.1.1.381
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThanOrEqual: "10.1.2.382",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-27323",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-02T13:08:49.783296Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-19T19:25:27.382Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T00:34:51.004Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "ZDI-24-198",
                  tags: [
                     "x_research-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-24-198/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.1.1.381",
                  },
               ],
            },
         ],
         dateAssigned: "2024-02-23T13:45:34.656-06:00",
         datePublic: "2024-02-23T15:29:30.647-06:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this vulnerability.\n\nThe specific flaw exists within the update functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22224.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-295",
                     description: "CWE-295: Improper Certificate Validation",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-04-01T21:48:49.889Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-198",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-198/",
            },
         ],
         source: {
            lang: "en",
            value: "Bobby Gould and Anthony Fuller of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-27323",
      datePublished: "2024-04-01T21:48:49.889Z",
      dateReserved: "2024-02-23T19:42:40.846Z",
      dateUpdated: "2024-08-02T00:34:51.004Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42375 (GCVE-0-2022-42375)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:42
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18404.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1362/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.312Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1362/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42375",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:42:35.544472Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:42:47.506Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18404.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1362/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42375",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:42:47.506Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42386 (GCVE-0-2022-42386)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:25
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18655.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1377/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.310Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1377/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42386",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T14:25:02.196971Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:25:10.712Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18655.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1377/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42386",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:25:10.712Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8828 (GCVE-0-2024-8828)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24313.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1251/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8828",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:53.607744Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:26.658Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:34.435-05:00",
         datePublic: "2024-09-17T11:25:05.612-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24313.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:19.809Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1251",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1251/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8828",
      datePublished: "2024-11-22T21:04:19.809Z",
      dateReserved: "2024-09-13T18:15:34.359Z",
      dateUpdated: "2024-11-23T01:26:26.658Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8816 (GCVE-0-2024-8816)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24211.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1239/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8816",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:19:35.421626Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:27.509Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:14:45.627-05:00",
         datePublic: "2024-09-17T11:23:38.190-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24211.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416: Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:29.117Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1239",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1239/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8816",
      datePublished: "2024-11-22T21:03:29.117Z",
      dateReserved: "2024-09-13T18:14:45.547Z",
      dateUpdated: "2024-11-23T01:26:27.509Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42376 (GCVE-0-2022-42376)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:41
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18529.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1363/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.287Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1363/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42376",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:41:51.403673Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:41:58.724Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "khangkito - Tran Van Khang (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18529.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1363/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42376",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:41:58.724Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8817 (GCVE-0-2024-8817)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24212.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1240/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8817",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:03:15.878415Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:22.673Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:14:56.129-05:00",
         datePublic: "2024-09-17T11:23:45.693-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24212.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:33.829Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1240",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1240/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8817",
      datePublished: "2024-11-22T21:03:33.829Z",
      dateReserved: "2024-09-13T18:14:56.051Z",
      dateUpdated: "2024-11-25T19:06:22.673Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8825 (GCVE-0-2024-8825)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-25 19:16
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24263.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1248/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8825",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:06:45.277093Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:16:23.480Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:24.999-05:00",
         datePublic: "2024-09-17T11:24:42.231-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24263.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:08.357Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1248",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1248/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8825",
      datePublished: "2024-11-22T21:04:08.357Z",
      dateReserved: "2024-09-13T18:15:24.918Z",
      dateUpdated: "2024-11-25T19:16:23.480Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8814 (GCVE-0-2024-8814)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24209.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1237/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8814",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:03:10.938738Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:22.433Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:14:39.183-05:00",
         datePublic: "2024-09-17T11:23:22.249-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24209.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:21.169Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1237",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1237/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8814",
      datePublished: "2024-11-22T21:03:21.169Z",
      dateReserved: "2024-09-13T18:14:39.106Z",
      dateUpdated: "2024-11-25T19:06:22.433Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37354 (GCVE-0-2022-37354)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:45
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17628.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1082/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.782Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1082/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37354",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:35:38.275610Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:45:45.939Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17628.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1082/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37354",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:45:45.939Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42369 (GCVE-0-2022-42369)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:47
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18344.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1351/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.281Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1351/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42369",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:47:21.673233Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:47:28.743Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18344.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1351/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42369",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:47:28.743Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42409 (GCVE-0-2022-42409)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:46
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18315.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1340/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.427Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1340/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42409",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:37:31.802914Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:46:12.250Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Anonymous",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18315.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1340/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42409",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:46:12.250Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42380 (GCVE-0-2022-42380)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:40
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18649.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1371/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.178Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1371/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42380",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:40:20.534349Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:40:28.663Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18649.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1371/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42380",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:40:28.663Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37366 (GCVE-0-2022-37366)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:16
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17727.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1094/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.945Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1094/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37366",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:15:49.776467Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:16:13.300Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17727.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1094/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37366",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:16:13.300Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8818 (GCVE-0-2024-8818)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24213.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1241/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8818",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:03:18.605726Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:22.856Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:14:59.591-05:00",
         datePublic: "2024-09-17T11:23:53.734-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24213.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416: Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:39.633Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1241",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1241/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8818",
      datePublished: "2024-11-22T21:03:39.633Z",
      dateReserved: "2024-09-13T18:14:59.512Z",
      dateUpdated: "2024-11-25T19:06:22.856Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37373 (GCVE-0-2022-37373)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:11
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17810.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1101/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.903Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1101/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37373",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:11:53.836291Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:11:59.417Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Anonymous",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17810.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1101/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37373",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:11:59.417Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42372 (GCVE-0-2022-42372)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:46
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18347.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1354/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.319Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1354/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42372",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:46:04.443610Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:46:29.276Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18347.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1354/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42372",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:46:29.276Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42415 (GCVE-0-2022-42415)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:44
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18366.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1356/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.468Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1356/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42415",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:14:12.549318Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:44:41.744Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18366.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1356/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42415",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:44:41.744Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0909 (GCVE-0-2025-0909)
Vulnerability from cvelistv5
Published
2025-02-11 19:58
Modified
2025-02-11 20:54
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25678.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-064/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.3.391
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0909",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-11T20:54:32.562208Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-11T20:54:36.233Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.3.391",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:49.192Z",
         datePublic: "2025-01-31T22:06:53.954Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25678.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:58:09.870Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-064",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-064/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0909",
      datePublished: "2025-02-11T19:58:09.870Z",
      dateReserved: "2025-01-30T20:36:49.145Z",
      dateUpdated: "2025-02-11T20:54:36.233Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0899 (GCVE-0-2025-0899)
Vulnerability from cvelistv5
Published
2025-02-11 19:22
Modified
2025-02-12 20:11
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25349.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-061/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.1.387
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0899",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-11T19:55:12.756620Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T20:11:33.512Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.1.387",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:06.627Z",
         datePublic: "2025-01-31T22:06:12.503Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25349.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416: Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:22:58.592Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-061",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-061/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0899",
      datePublished: "2025-02-11T19:22:58.592Z",
      dateReserved: "2025-01-30T20:36:06.509Z",
      dateUpdated: "2025-02-12T20:11:33.512Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42396 (GCVE-0-2022-42396)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:50
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18278.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1332/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.489Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1332/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42396",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:36:49.536660Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:50:29.888Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "khangkito - Tran Van Khang (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18278.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-822",
                     description: "CWE-822: Untrusted Pointer Dereference",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1332/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42396",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:50:29.888Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37357 (GCVE-0-2022-37357)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:53
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. Crafted data in an ICO file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17631.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1085/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.898Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1085/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37357",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:24:31.025537Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:53:03.619Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. Crafted data in an ICO file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17631.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1085/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37357",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:53:03.619Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42377 (GCVE-0-2022-42377)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:41
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18630.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1367/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.435Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1367/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42377",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:41:32.930841Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:41:40.064Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18630.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-119",
                     description: "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1367/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42377",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:41:40.064Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37375 (GCVE-0-2022-37375)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:11
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18069.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1103/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.896Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1103/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37375",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:11:38.196386Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:11:42.504Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18069.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1103/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37375",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:11:42.504Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37349 (GCVE-0-2022-37349)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:12
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the submitForm method. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17142.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1076/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.804Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1076/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37349",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:12:13.908129Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:12:34.177Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Suyue Guo and Wei You from Renmin University of China",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the submitForm method. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17142.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1076/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37349",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:12:34.177Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8827 (GCVE-0-2024-8827)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-25 19:16
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor PPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24306.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1250/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8827",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:06:49.022078Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:16:23.621Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:31.671-05:00",
         datePublic: "2024-09-17T11:24:58.362-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor PPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24306.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:15.754Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1250",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1250/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor PPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8827",
      datePublished: "2024-11-22T21:04:15.754Z",
      dateReserved: "2024-09-13T18:15:31.584Z",
      dateUpdated: "2024-11-25T19:16:23.621Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0903 (GCVE-0-2025-0903)
Vulnerability from cvelistv5
Published
2025-02-11 19:57
Modified
2025-02-12 14:28
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RTF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25421.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-070/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.0.388
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0903",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-12T14:28:36.515564Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T14:28:48.265Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.0.388",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:21.943Z",
         datePublic: "2025-01-31T22:08:29.392Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of RTF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25421.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-122",
                     description: "CWE-122: Heap-based Buffer Overflow",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:57:00.237Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-070",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-070/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0903",
      datePublished: "2025-02-11T19:57:00.237Z",
      dateReserved: "2025-01-30T20:36:21.877Z",
      dateUpdated: "2025-02-12T14:28:48.265Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42383 (GCVE-0-2022-42383)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:39
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18652.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1374/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.152Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1374/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42383",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:39:13.204659Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:39:22.412Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18652.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1374/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42383",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:39:22.412Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8845 (GCVE-0-2024-8845)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24553.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1268/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8845",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:17:53.589538Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:25.392Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:17:01.345-05:00",
         datePublic: "2024-09-17T11:27:03.133-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24553.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:33.404Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1268",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1268/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8845",
      datePublished: "2024-11-22T21:05:33.404Z",
      dateReserved: "2024-09-13T18:17:01.262Z",
      dateUpdated: "2024-11-23T01:26:25.392Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0907 (GCVE-0-2025-0907)
Vulnerability from cvelistv5
Published
2025-02-11 19:57
Modified
2025-02-12 14:27
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25435.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-069/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.0.388
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0907",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-12T14:26:51.644229Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T14:27:12.983Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.0.388",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:40.807Z",
         datePublic: "2025-01-31T22:08:14.571Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25435.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:57:51.572Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-069",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-069/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0907",
      datePublished: "2025-02-11T19:57:51.572Z",
      dateReserved: "2025-01-30T20:36:40.756Z",
      dateUpdated: "2025-02-12T14:27:12.983Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42371 (GCVE-0-2022-42371)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:46
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18346.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1353/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.347Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1353/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42371",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:46:44.589636Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:46:52.444Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18346.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1353/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42371",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:46:52.444Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42408 (GCVE-0-2022-42408)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 13:53
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18543.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1366/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.490Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1366/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42408",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T13:53:38.077292Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T13:53:52.042Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Anonymous",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18543.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416: Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1366/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42408",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T13:53:52.042Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42421 (GCVE-0-2022-42421)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 17:37
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18703.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1393/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.865Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1393/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42421",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T17:37:18.621116Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T17:37:26.445Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18703.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1393/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42421",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T17:37:26.445Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0905 (GCVE-0-2025-0905)
Vulnerability from cvelistv5
Published
2025-02-11 19:57
Modified
2025-02-12 14:28
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25433.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-067/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.0.388
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0905",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-12T14:27:47.254604Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T14:28:01.800Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.0.388",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:29.436Z",
         datePublic: "2025-01-31T22:07:55.139Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25433.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:57:31.522Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-067",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-067/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0905",
      datePublished: "2025-02-11T19:57:31.522Z",
      dateReserved: "2025-01-30T20:36:29.382Z",
      dateUpdated: "2025-02-12T14:28:01.800Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8836 (GCVE-0-2024-8836)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24354.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1259/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8836",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:24.271112Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:25.984Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:11.625-05:00",
         datePublic: "2024-09-17T11:26:01.767-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24354.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:56.362Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1259",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1259/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8836",
      datePublished: "2024-11-22T21:04:56.362Z",
      dateReserved: "2024-09-13T18:16:11.537Z",
      dateUpdated: "2024-11-23T01:26:25.984Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37356 (GCVE-0-2022-37356)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:52
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17630.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1084/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.783Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1084/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37356",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:31:15.371980Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:52:21.634Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17630.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1084/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37356",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:52:21.634Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37360 (GCVE-0-2022-37360)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:54
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17635.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1088/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.828Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1088/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37360",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:17:02.090945Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:54:50.707Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17635.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1088/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37360",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:54:50.707Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37351 (GCVE-0-2022-37351)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:44
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17636.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1079/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.689Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1079/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37351",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:41:16.731287Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:44:01.320Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17636.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1079/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37351",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:44:01.320Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42385 (GCVE-0-2022-42385)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:38
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18654.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1376/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.208Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1376/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42385",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:38:29.204625Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:38:37.983Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18654.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1376/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42385",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:38:37.983Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41145 (GCVE-0-2022-41145)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:48
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18283.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1335/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.366Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1335/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41145",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T14:48:09.156011Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:48:16.596Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "khangkito - Tran Van Khang (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18283.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1335/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41145",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:48:16.596Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42412 (GCVE-0-2022-42412)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:45
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18324.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1341/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.898Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1341/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42412",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:37:59.678213Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:45:29.135Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18324.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1341/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42412",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:45:29.135Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42393 (GCVE-0-2022-42393)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:51
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18662.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1384/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.318Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1384/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42393",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:36:24.304177Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:51:19.046Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18662.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1384/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42393",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:51:19.046Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8833 (GCVE-0-2024-8833)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24318.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1256/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8833",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:05:21.607900Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:23.573Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:55.858-05:00",
         datePublic: "2024-09-17T11:25:41.599-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24318.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:38.389Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1256",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1256/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8833",
      datePublished: "2024-11-22T21:04:38.389Z",
      dateReserved: "2024-09-13T18:15:55.777Z",
      dateUpdated: "2024-11-25T19:06:23.573Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42411 (GCVE-0-2022-42411)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:45
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18306.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1338/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.443Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1338/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42411",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:37:44.906970Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:45:43.999Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18306.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1338/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42411",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:45:43.999Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42398 (GCVE-0-2022-42398)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:49
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18307.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1339/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.415Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1339/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42398",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:37:09.324670Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:49:57.979Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18307.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1339/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42398",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:49:57.979Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-27327 (GCVE-0-2024-27327)
Vulnerability from cvelistv5
Published
2024-04-01 21:50
Modified
2024-08-02 00:34
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22277.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-205/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.1.1.381
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.1.2.382",
                        status: "affected",
                        version: "10.1.1.381",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-27327",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-07-19T15:34:37.522246Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-19T21:07:20.480Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T00:34:51.416Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "ZDI-24-205",
                  tags: [
                     "x_research-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-24-205/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.1.1.381",
                  },
               ],
            },
         ],
         dateAssigned: "2024-02-23T13:45:34.705-06:00",
         datePublic: "2024-02-23T15:30:29.257-06:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22277.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-04-01T21:50:07.123Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-205",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-205/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-27327",
      datePublished: "2024-04-01T21:50:07.123Z",
      dateReserved: "2024-02-23T19:42:40.846Z",
      dateUpdated: "2024-08-02T00:34:51.416Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0908 (GCVE-0-2025-0908)
Vulnerability from cvelistv5
Published
2025-02-11 19:58
Modified
2025-02-12 14:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25557.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-063/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.2.390
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0908",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-12T14:25:59.111099Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T14:26:04.015Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.2.390",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:45.597Z",
         datePublic: "2025-02-05T23:26:49.988Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25557.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:58:02.722Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-063",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-063/",
            },
         ],
         source: {
            lang: "en",
            value: "Anonymous",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0908",
      datePublished: "2025-02-11T19:58:02.722Z",
      dateReserved: "2025-01-30T20:36:45.543Z",
      dateUpdated: "2025-02-12T14:26:04.015Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8821 (GCVE-0-2024-8821)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24216.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1244/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8821",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:19:18.167062Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:27.134Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:10.206-05:00",
         datePublic: "2024-09-17T11:24:15.237-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24216.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416: Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:52.635Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1244",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1244/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8821",
      datePublished: "2024-11-22T21:03:52.635Z",
      dateReserved: "2024-09-13T18:15:10.126Z",
      dateUpdated: "2024-11-23T01:26:27.134Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8830 (GCVE-0-2024-8830)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24315.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1253/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8830",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:05:14.303318Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:23.181Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:42.751-05:00",
         datePublic: "2024-09-17T11:25:21.903-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24315.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:27.270Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1253",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1253/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8830",
      datePublished: "2024-11-22T21:04:27.270Z",
      dateReserved: "2024-09-13T18:15:42.673Z",
      dateUpdated: "2024-11-25T19:06:23.181Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8832 (GCVE-0-2024-8832)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24317.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1255/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8832",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:41.889394Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:26.420Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:51.156-05:00",
         datePublic: "2024-09-17T11:25:34.743-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24317.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:34.425Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1255",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1255/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8832",
      datePublished: "2024-11-22T21:04:34.425Z",
      dateReserved: "2024-09-13T18:15:51.073Z",
      dateUpdated: "2024-11-23T01:26:26.420Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37358 (GCVE-0-2022-37358)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:53
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17632.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1086/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.902Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1086/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37358",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:21:27.351671Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:53:46.332Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17632.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1086/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37358",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:53:46.332Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42400 (GCVE-0-2022-42400)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:37
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18328.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1344/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.431Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1344/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42400",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:37:10.392395Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:37:18.465Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18328.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1344/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42400",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:37:18.465Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37359 (GCVE-0-2022-37359)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:54
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17633.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1087/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.750Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1087/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37359",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:19:11.435044Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:54:16.354Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17633.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416: Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1087/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37359",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:54:16.354Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41150 (GCVE-0-2022-41150)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:26
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18340.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1347/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.391Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1347/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41150",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T14:26:35.452952Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:26:52.666Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18340.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1347/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41150",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:26:52.666Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41144 (GCVE-0-2022-41144)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:53
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18282.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1334/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.454Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1334/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41144",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:45:28.986698Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:53:10.533Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "khangkito - Tran Van Khang (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18282.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1334/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41144",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:53:10.533Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42374 (GCVE-0-2022-42374)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:45
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18403.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1361/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.399Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1361/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42374",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:44:56.547599Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:45:04.618Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18403.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416: Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1361/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42374",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:45:04.618Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42394 (GCVE-0-2022-42394)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:51
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18893.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1392/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.416Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1392/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42394",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:36:33.898960Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:51:00.569Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18893.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1392/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42394",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:51:00.569Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-27328 (GCVE-0-2024-27328)
Vulnerability from cvelistv5
Published
2024-04-01 21:50
Modified
2024-08-02 00:34
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22280.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-202/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.1.1.381
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-27328",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-02T13:07:41.096975Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:47:27.757Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T00:34:51.335Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "ZDI-24-202",
                  tags: [
                     "x_research-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-24-202/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.1.1.381",
                  },
               ],
            },
         ],
         dateAssigned: "2024-02-23T13:45:34.712-06:00",
         datePublic: "2024-02-23T15:30:05.020-06:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22280.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-04-01T21:50:17.719Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-202",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-202/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-27328",
      datePublished: "2024-04-01T21:50:17.719Z",
      dateReserved: "2024-02-23T19:42:40.846Z",
      dateUpdated: "2024-08-02T00:34:51.335Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42399 (GCVE-0-2022-42399)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:38
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18327.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1343/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.438Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1343/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42399",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:38:06.428954Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:38:13.511Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18327.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1343/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42399",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:38:13.511Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42390 (GCVE-0-2022-42390)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:52
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18659.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1381/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.290Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1381/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42390",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:44:57.044627Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:52:08.710Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18659.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1381/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42390",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:52:08.710Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8831 (GCVE-0-2024-8831)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24316.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1254/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8831",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:05:17.871738Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:23.395Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:47.819-05:00",
         datePublic: "2024-09-17T11:25:28.428-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. \n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24316.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:30.850Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1254",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1254/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8831",
      datePublished: "2024-11-22T21:04:30.850Z",
      dateReserved: "2024-09-13T18:15:47.736Z",
      dateUpdated: "2024-11-25T19:06:23.395Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8837 (GCVE-0-2024-8837)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24408.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1260/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8837",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:05:25.058181Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:23.693Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:16.635-05:00",
         datePublic: "2024-09-17T11:26:09.245-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24408.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:01.357Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1260",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1260/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8837",
      datePublished: "2024-11-22T21:05:01.357Z",
      dateReserved: "2024-09-13T18:16:16.559Z",
      dateUpdated: "2024-11-25T19:06:23.693Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8815 (GCVE-0-2024-8815)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24210.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1238/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8815",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:03:13.561031Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:22.575Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:14:42.474-05:00",
         datePublic: "2024-09-17T11:23:29.313-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24210.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-119",
                     description: "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:25.503Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1238",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1238/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Memory Corruption Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8815",
      datePublished: "2024-11-22T21:03:25.503Z",
      dateReserved: "2024-09-13T18:14:42.397Z",
      dateUpdated: "2024-11-25T19:06:22.575Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42407 (GCVE-0-2022-42407)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:46
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18542.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1365/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.450Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1365/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42407",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:37:25.990425Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:46:44.045Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Anonymous",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18542.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1365/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42407",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:46:44.045Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37365 (GCVE-0-2022-37365)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:14
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the saveAs method. The application exposes a JavaScript interface that allows the attacker to write arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-17527.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1093/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.656Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1093/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37365",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:14:40.388210Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:14:45.602Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "kimiya",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the saveAs method. The application exposes a JavaScript interface that allows the attacker to write arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-17527.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-749",
                     description: "CWE-749: Exposed Dangerous Method or Function",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1093/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37365",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:14:45.602Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42403 (GCVE-0-2022-42403)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-27 19:52
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18892.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1391/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.432Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1391/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42403",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-27T19:52:16.651226Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-27T19:52:33.470Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18892.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-122",
                     description: "CWE-122: Heap-based Buffer Overflow",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1391/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42403",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-27T19:52:33.470Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37367 (GCVE-0-2022-37367)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:16
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. Crafted data in an AcroForm can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17726.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1095/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.938Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1095/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37367",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:16:33.956289Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:16:46.282Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. Crafted data in an AcroForm can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17726.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1095/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37367",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:16:46.282Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-7352 (GCVE-0-2024-7352)
Vulnerability from cvelistv5
Published
2024-11-22 21:31
Modified
2024-11-26 16:03
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23550.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1037/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.2.1.385
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unaffected",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        status: "affected",
                        version: "10.2.1.385",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-7352",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-26T16:02:30.648188Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-26T16:03:25.591Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.2.1.385",
                  },
               ],
            },
         ],
         dateAssigned: "2024-07-31T15:59:10.647-05:00",
         datePublic: "2024-07-31T16:20:03.759-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23550.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:31:02.811Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1037",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1037/",
            },
         ],
         source: {
            lang: "en",
            value: "Anonymous",
         },
         title: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-7352",
      datePublished: "2024-11-22T21:31:02.811Z",
      dateReserved: "2024-07-31T20:59:10.645Z",
      dateUpdated: "2024-11-26T16:03:25.591Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42420 (GCVE-0-2022-42420)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 17:38
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18686.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1388/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.479Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1388/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42420",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T17:38:03.246792Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T17:38:12.895Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18686.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1388/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42420",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T17:38:12.895Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42402 (GCVE-0-2022-42402)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 18:44
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in an embedded U3D object can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18632.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1369/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.274Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1369/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42402",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T18:43:56.165805Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T18:44:57.881Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in an embedded U3D object can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18632.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1369/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42402",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T18:44:57.881Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42417 (GCVE-0-2022-42417)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 18:39
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18676.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1386/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.821Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1386/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42417",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T18:39:10.310521Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T18:39:21.054Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18676.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1386/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42417",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T18:39:21.054Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-27326 (GCVE-0-2024-27326)
Vulnerability from cvelistv5
Published
2024-04-01 21:49
Modified
2024-08-02 00:34
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22276.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-204/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.1.1.381
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-27326",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-03T14:42:54.567807Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:46:42.524Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T00:34:51.382Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "ZDI-24-204",
                  tags: [
                     "x_research-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-24-204/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.1.1.381",
                  },
               ],
            },
         ],
         dateAssigned: "2024-02-23T13:45:34.698-06:00",
         datePublic: "2024-02-23T15:30:20.432-06:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22276.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-04-01T21:49:28.789Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-204",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-204/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-27326",
      datePublished: "2024-04-01T21:49:28.789Z",
      dateReserved: "2024-02-23T19:42:40.846Z",
      dateUpdated: "2024-08-02T00:34:51.382Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-27329 (GCVE-0-2024-27329)
Vulnerability from cvelistv5
Published
2024-04-01 21:50
Modified
2025-03-12 16:42
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22285.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-200/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.1.1.381
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-27329",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-02T15:02:54.108130Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-12T16:42:25.359Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T00:34:51.395Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "ZDI-24-200",
                  tags: [
                     "x_research-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-24-200/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.1.1.381",
                  },
               ],
            },
         ],
         dateAssigned: "2024-02-23T19:45:34.725Z",
         datePublic: "2024-02-23T21:29:50.372Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22285.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-04-01T21:50:29.908Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-200",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-200/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-27329",
      datePublished: "2024-04-01T21:50:29.908Z",
      dateReserved: "2024-02-23T19:42:40.846Z",
      dateUpdated: "2025-03-12T16:42:25.359Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0902 (GCVE-0-2025-0902)
Vulnerability from cvelistv5
Published
2025-02-11 19:56
Modified
2025-02-12 14:29
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25405.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-072/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.0.388
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0902",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-12T14:29:00.866998Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T14:29:11.400Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.0.388",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:18.299Z",
         datePublic: "2025-01-31T22:08:51.210Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25405.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:56:41.379Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-072",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-072/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0902",
      datePublished: "2025-02-11T19:56:41.379Z",
      dateReserved: "2025-01-30T20:36:18.231Z",
      dateUpdated: "2025-02-12T14:29:11.400Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42378 (GCVE-0-2022-42378)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:41
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18631.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1368/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.490Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1368/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42378",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:41:16.020346Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:41:22.586Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18631.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1368/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42378",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:41:22.586Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42404 (GCVE-0-2022-42404)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 18:42
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18273.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1330/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.286Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1330/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42404",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T18:42:37.911831Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T18:42:47.087Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "khangkito - Tran Van Khang (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18273.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1330/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42404",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T18:42:47.087Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8847 (GCVE-0-2024-8847)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-22 21:35
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25198.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1270/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.1.387
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        status: "affected",
                        version: "10.3.1.387",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8847",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-22T21:34:25.402856Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-22T21:35:52.663Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.1.387",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:17:12.498-05:00",
         datePublic: "2024-09-17T11:27:22.309-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25198.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:41.745Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1270",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1270/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8847",
      datePublished: "2024-11-22T21:05:41.745Z",
      dateReserved: "2024-09-13T18:17:12.418Z",
      dateUpdated: "2024-11-22T21:35:52.663Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8840 (GCVE-0-2024-8840)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-25 19:16
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-24420.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1263/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8840",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:06:53.443743Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:16:23.750Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:40.024-05:00",
         datePublic: "2024-09-17T11:26:29.189-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-24420.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:13.709Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1263",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1263/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8840",
      datePublished: "2024-11-22T21:05:13.709Z",
      dateReserved: "2024-09-13T18:16:39.947Z",
      dateUpdated: "2024-11-25T19:16:23.750Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8843 (GCVE-0-2024-8843)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24495.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1266/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8843",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:06.279240Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:25.620Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:52.245-05:00",
         datePublic: "2024-09-17T11:26:49.927-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24495.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:26.016Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1266",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1266/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8843",
      datePublished: "2024-11-22T21:05:26.016Z",
      dateReserved: "2024-09-13T18:16:52.168Z",
      dateUpdated: "2024-11-23T01:26:25.620Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42401 (GCVE-0-2022-42401)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-03-31 18:46
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18533.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1364/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.438Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1364/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42401",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T18:46:15.462141Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-31T18:46:25.064Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Rocco Calvi (@TecR0c) with TecSecurity",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18533.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1364/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42401",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-03-31T18:46:25.064Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8824 (GCVE-0-2024-8824)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24262.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1247/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8824",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:59.460421Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:26.764Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:21.305-05:00",
         datePublic: "2024-09-17T11:24:35.678-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24262.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:04.075Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1247",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1247/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8824",
      datePublished: "2024-11-22T21:04:04.075Z",
      dateReserved: "2024-09-13T18:15:21.227Z",
      dateUpdated: "2024-11-23T01:26:26.764Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8846 (GCVE-0-2024-8846)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-22 21:39
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24835.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1269/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.1.387
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8846",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-22T21:39:03.773683Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-22T21:39:31.688Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.1.387",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:17:05.560-05:00",
         datePublic: "2024-09-17T11:27:14.894-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24835.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:37.132Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1269",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1269/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8846",
      datePublished: "2024-11-22T21:05:37.132Z",
      dateReserved: "2024-09-13T18:17:05.472Z",
      dateUpdated: "2024-11-22T21:39:31.688Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42391 (GCVE-0-2022-42391)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:51
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18660.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1382/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.182Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1382/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42391",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:35:58.470141Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:51:47.925Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18660.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1382/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42391",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:51:47.925Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37364 (GCVE-0-2022-37364)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:25
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17634.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1092/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.918Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1092/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37364",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:25:49.108181Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:25:56.718Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17634.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1092/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37364",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:25:56.718Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41146 (GCVE-0-2022-41146)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:36
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18284.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1336/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.375Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1336/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41146",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T14:36:20.234625Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:36:28.234Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "khangkito - Tran Van Khang (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18284.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1336/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41146",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:36:28.234Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37353 (GCVE-0-2022-37353)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:45
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17637.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1081/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.937Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1081/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37353",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:37:13.818748Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:45:16.016Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17637.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1081/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37353",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:45:16.016Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42397 (GCVE-0-2022-42397)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:50
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18279.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1333/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.439Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1333/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42397",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:36:58.941291Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:50:14.917Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "khangkito - Tran Van Khang (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18279.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1333/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42397",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:50:14.917Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37352 (GCVE-0-2022-37352)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:44
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WMF files. Crafted data in a WMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17638.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1080/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.944Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1080/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37352",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:39:45.567845Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:44:35.618Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WMF files. Crafted data in a WMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17638.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1080/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37352",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:44:35.618Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37368 (GCVE-0-2022-37368)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:21
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17728.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1096/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.701Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1096/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37368",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:21:15.458481Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:21:19.192Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17728.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1096/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37368",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:21:19.192Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8813 (GCVE-0-2024-8813)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24208.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1236/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8813",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:03:08.576705Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:21.539Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:14:35.253-05:00",
         datePublic: "2024-09-17T11:23:13.913-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24208.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:18.275Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1236",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1236/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8813",
      datePublished: "2024-11-22T21:03:18.275Z",
      dateReserved: "2024-09-13T18:14:35.167Z",
      dateUpdated: "2024-11-25T19:06:21.539Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42379 (GCVE-0-2022-42379)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:40
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18648.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1370/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.363.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.338Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1370/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42379",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:40:43.210915Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:40:50.615Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.363.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18648.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1370/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42379",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:40:50.615Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37362 (GCVE-0-2022-37362)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:14
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. Crafted data in a PNG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17660.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1090/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.914Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1090/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37362",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:14:17.212208Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:14:26.154Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. Crafted data in a PNG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17660.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1090/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37362",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:14:26.154Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42370 (GCVE-0-2022-42370)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 13:47
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18345.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1352/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.286Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1352/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42370",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T13:47:01.938478Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T13:47:09.758Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18345.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1352/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42370",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T13:47:09.758Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-27325 (GCVE-0-2024-27325)
Vulnerability from cvelistv5
Published
2024-04-01 21:49
Modified
2024-08-02 00:34
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22275.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-203/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.1.1.381
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-27325",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-02T14:48:22.098878Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:47:20.571Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T00:34:51.003Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "ZDI-24-203",
                  tags: [
                     "x_research-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-24-203/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.1.1.381",
                  },
               ],
            },
         ],
         dateAssigned: "2024-02-23T13:45:34.685-06:00",
         datePublic: "2024-02-23T15:30:12.237-06:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22275.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-04-01T21:49:14.636Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-203",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-203/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-27325",
      datePublished: "2024-04-01T21:49:14.636Z",
      dateReserved: "2024-02-23T19:42:40.846Z",
      dateUpdated: "2024-08-02T00:34:51.003Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37355 (GCVE-0-2022-37355)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 16:51
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17629.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1083/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.771Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1083/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37355",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T15:32:57.395676Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T16:51:44.798Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17629.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1083/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37355",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T16:51:44.798Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41149 (GCVE-0-2022-41149)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:27
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18339.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1346/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.440Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1346/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41149",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-04-01T14:27:15.289995Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:27:21.749Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18339.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1346/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41149",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:27:21.749Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-42395 (GCVE-0-2022-42395)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:50
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18274.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1331/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T13:10:40.390Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1331/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-42395",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:36:42.444403Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:50:45.387Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Tran Van Khang - khangkito (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18274.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1331/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-42395",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-10-03T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:50:45.387Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8822 (GCVE-0-2024-8822)
Vulnerability from cvelistv5
Published
2024-11-22 21:03
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24217.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1245/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8822",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:19:11.998485Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:26.990Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:13.357-05:00",
         datePublic: "2024-09-17T11:24:22.301-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24217.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:03:56.394Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1245",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1245/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8822",
      datePublished: "2024-11-22T21:03:56.394Z",
      dateReserved: "2024-09-13T18:15:13.279Z",
      dateUpdated: "2024-11-23T01:26:26.990Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8838 (GCVE-0-2024-8838)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24409.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1261/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8838",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:05:28.629270Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:23.827Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:30.217-05:00",
         datePublic: "2024-09-17T11:26:15.650-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24409.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:04.864Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1261",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1261/",
            },
         ],
         source: {
            lang: "en",
            value: "Mat Powell of Trend Micro Zero Day Initiative",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8838",
      datePublished: "2024-11-22T21:05:04.864Z",
      dateReserved: "2024-09-13T18:16:30.140Z",
      dateUpdated: "2024-11-25T19:06:23.827Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-37371 (GCVE-0-2022-37371)
Vulnerability from cvelistv5
Published
2023-03-29 00:00
Modified
2025-02-18 19:24
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17772.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1099/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.3.361.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T10:29:20.800Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1099/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-37371",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-18T19:24:47.489844Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-18T19:24:51.232Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.3.361.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Mat Powell of Trend Micro Zero Day Initiative",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17772.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-29T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1099/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-37371",
      datePublished: "2023-03-29T00:00:00.000Z",
      dateReserved: "2022-08-02T00:00:00.000Z",
      dateUpdated: "2025-02-18T19:24:51.232Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2025-0910 (GCVE-0-2025-0910)
Vulnerability from cvelistv5
Published
2025-02-11 19:58
Modified
2025-02-12 15:29
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25748.
References
https://www.zerodayinitiative.com/advisories/ZDI-25-065/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.4.3.391
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-0910",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-11T20:31:04.883430Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T15:29:36.125Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.4.3.391",
                  },
               ],
            },
         ],
         dateAssigned: "2025-01-30T20:36:52.930Z",
         datePublic: "2025-01-31T22:07:09.210Z",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25748.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-11T19:58:17.542Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-25-065",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-25-065/",
            },
         ],
         source: {
            lang: "en",
            value: "Anonymous",
         },
         title: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2025-0910",
      datePublished: "2025-02-11T19:58:17.542Z",
      dateReserved: "2025-01-30T20:36:52.883Z",
      dateUpdated: "2025-02-12T15:29:36.125Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8839 (GCVE-0-2024-8839)
Vulnerability from cvelistv5
Published
2024-11-22 21:05
Modified
2024-11-23 01:26
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24419.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1262/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8839",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-23T01:18:18.382479Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-23T01:26:25.871Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:16:35.659-05:00",
         datePublic: "2024-09-17T11:26:22.173-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24419.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:05:08.578Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1262",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1262/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8839",
      datePublished: "2024-11-22T21:05:08.578Z",
      dateReserved: "2024-09-13T18:16:35.583Z",
      dateUpdated: "2024-11-23T01:26:25.871Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2022-41143 (GCVE-0-2022-41143)
Vulnerability from cvelistv5
Published
2023-01-26 00:00
Modified
2025-04-01 14:53
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18225.
References
https://www.tracker-software.com/product/pdf-xchange-editor/history
https://www.zerodayinitiative.com/advisories/ZDI-22-1329/
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 9.4.362.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T12:35:49.250Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1329/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-41143",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-31T15:45:54.215054Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-04-01T14:53:25.529Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "9.4.362.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "khangkito - Tran Van Khang (VinCSS)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18225.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-787",
                     description: "CWE-787: Out-of-bounds Write",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-26T00:00:00.000Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
            },
            {
               url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1329/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2022-41143",
      datePublished: "2023-01-26T00:00:00.000Z",
      dateReserved: "2022-09-20T00:00:00.000Z",
      dateUpdated: "2025-04-01T14:53:25.529Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2023-24308 (GCVE-0-2023-24308)
Vulnerability from cvelistv5
Published
2023-03-28 00:00
Modified
2025-02-19 15:34
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker Software may allow attackers to execute code when a user opens a crafted PDF file. The issue occurs when handling a large number of objects in a PDF file.
References
https://www.sit.fraunhofer.de/cve-2023-24308/
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T10:56:03.470Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.sit.fraunhofer.de/cve-2023-24308/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "LOCAL",
                     availabilityImpact: "HIGH",
                     baseScore: 7.8,
                     baseSeverity: "HIGH",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "HIGH",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "REQUIRED",
                     vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2023-24308",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-19T15:34:40.962967Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-755",
                        description: "CWE-755 Improper Handling of Exceptional Conditions",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-19T15:34:46.024Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker Software may allow attackers to execute code when a user opens a crafted PDF file. The issue occurs when handling a large number of objects in a PDF file.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-28T00:00:00.000Z",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://www.sit.fraunhofer.de/cve-2023-24308/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2023-24308",
      datePublished: "2023-03-28T00:00:00.000Z",
      dateReserved: "2023-01-23T00:00:00.000Z",
      dateUpdated: "2025-02-19T15:34:46.024Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-8826 (GCVE-0-2024-8826)
Vulnerability from cvelistv5
Published
2024-11-22 21:04
Modified
2024-11-25 19:06
Severity ?
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24305.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-1249/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.3.0.386
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "pdf-xchange_editor",
                  vendor: "pdf-xchange",
                  versions: [
                     {
                        lessThan: "10.3.0.387",
                        status: "affected",
                        version: "10.3.0.386",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-8826",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-25T19:05:10.773501Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-25T19:06:22.965Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.3.0.386",
                  },
               ],
            },
         ],
         dateAssigned: "2024-09-13T13:15:28.523-05:00",
         datePublic: "2024-09-17T11:24:51.310-05:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24305.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-22T21:04:12.278Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-1249",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1249/",
            },
         ],
         source: {
            lang: "en",
            value: "Rocco Calvi (@TecR0c) with TecSecurity",
         },
         title: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-8826",
      datePublished: "2024-11-22T21:04:12.278Z",
      dateReserved: "2024-09-13T18:15:28.445Z",
      dateUpdated: "2024-11-25T19:06:22.965Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2024-27324 (GCVE-0-2024-27324)
Vulnerability from cvelistv5
Published
2024-04-01 21:49
Modified
2024-08-02 00:34
Severity ?
3.3 (Low) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22270.
References
https://www.zerodayinitiative.com/advisories/ZDI-24-196/x_research-advisory
Impacted products
Vendor Product Version
PDF-XChange PDF-XChange Editor Version: 10.1.1.381
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-27324",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-04-02T17:35:32.944290Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:47:32.018Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T00:34:50.997Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "ZDI-24-196",
                  tags: [
                     "x_research-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-24-196/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unknown",
               product: "PDF-XChange Editor",
               vendor: "PDF-XChange",
               versions: [
                  {
                     status: "affected",
                     version: "10.1.1.381",
                  },
               ],
            },
         ],
         dateAssigned: "2024-02-23T13:45:34.678-06:00",
         datePublic: "2024-02-23T15:29:14.598-06:00",
         descriptions: [
            {
               lang: "en",
               value: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22270.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125: Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-04-01T21:49:02.786Z",
            orgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
            shortName: "zdi",
         },
         references: [
            {
               name: "ZDI-24-196",
               tags: [
                  "x_research-advisory",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-24-196/",
            },
         ],
         source: {
            lang: "en",
            value: "Francis Provencher {PRL}",
         },
         title: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability",
      },
   },
   cveMetadata: {
      assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e",
      assignerShortName: "zdi",
      cveId: "CVE-2024-27324",
      datePublished: "2024-04-01T21:49:02.786Z",
      dateReserved: "2024-02-23T19:42:40.846Z",
      dateUpdated: "2024-08-02T00:34:50.997Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17630.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1084/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1084/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17630.",
      },
   ],
   id: "CVE-2022-37356",
   lastModified: "2025-02-18T17:15:14.680",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.683",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1084/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1084/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:56
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24207.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1235/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24207.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24207.",
      },
   ],
   id: "CVE-2024-8812",
   lastModified: "2024-12-04T14:56:07.463",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:19.333",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1235/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18716.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1390/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1390/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18716.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. Los datos manipulados en un archivo TIF pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18716.",
      },
   ],
   id: "CVE-2022-42423",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:58.587",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1390/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1390/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:20
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor PPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24306.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1250/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor PPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24306.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto fuera de los límites en el análisis de archivos PPM del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PPM. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24306.",
      },
   ],
   id: "CVE-2024-8827",
   lastModified: "2024-11-29T20:20:34.137",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:21.050",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1250/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18367.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1357/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1357/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18367.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos EMF. El problema se debe a la falta de una validación adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos en un búfer de almacenamiento dinámico. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18367.",
      },
   ],
   id: "CVE-2022-42405",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.417",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1357/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1357/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-122",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18328.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1344/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1344/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18328.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. Los datos manipulados en un archivo PDF pueden provocar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18328.",
      },
   ],
   id: "CVE-2022-42400",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.077",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1344/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1344/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18631.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1368/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1368/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18631.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18631.",
      },
   ],
   id: "CVE-2022-42378",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.410",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1368/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1368/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:18
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24317.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1255/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24317.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos EMF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos EMF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24317.",
      },
   ],
   id: "CVE-2024-8832",
   lastModified: "2024-11-29T20:18:52.840",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:21.647",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1255/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18369.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1359/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1359/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18369.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos EMF. Los datos manipulados en un archivo EMF pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18369.",
      },
   ],
   id: "CVE-2022-42406",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.487",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1359/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1359/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18274.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1331/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1331/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18274.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. Los datos manipulados en un archivo XPS pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18274.",
      },
   ],
   id: "CVE-2022-42395",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.727",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1331/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1331/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 16:42
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25269.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1272/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.1.387
pdf-xchange pdf-xchange_editor 10.3.1.387


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.1.387:*:*:*:*:*:*:*",
                     matchCriteriaId: "D0469A99-6E90-46A7-8698-77D7EB92D4C7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.1.387:*:*:*:*:*:*:*",
                     matchCriteriaId: "2198B487-C8B6-45E2-B12E-8F8DCB87334D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25269.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en AcroForm del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el manejo de AcroForms. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25269.",
      },
   ],
   id: "CVE-2024-8849",
   lastModified: "2024-12-04T16:42:10.820",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:23.650",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1272/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:20
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24313.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1251/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24313.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos EMF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos EMF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24313.",
      },
   ],
   id: "CVE-2024-8828",
   lastModified: "2024-11-29T20:20:25.293",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:21.167",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1251/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18649.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1371/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1371/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18649.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18649.",
      },
   ],
   id: "CVE-2022-42380",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.547",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1371/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1371/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:43
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24419.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1262/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24419.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos JB2 de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JB2. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24419.",
      },
   ],
   id: "CVE-2024-8839",
   lastModified: "2024-12-04T14:43:09.680",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:22.427",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1262/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the submitForm method. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17142.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1076/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1076/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the submitForm method. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17142.",
      },
   ],
   id: "CVE-2022-37349",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.023",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1076/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1076/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18344.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1351/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1351/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18344.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18344.",
      },
   ],
   id: "CVE-2022-42369",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.777",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1351/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1351/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18404.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1362/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1362/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18404.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18404.",
      },
   ],
   id: "CVE-2022-42375",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.203",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1362/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1362/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18659.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1381/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1381/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18659.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18659.",
      },
   ],
   id: "CVE-2022-42390",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.320",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1381/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1381/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 16:42
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24835.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1269/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.1.387
pdf-xchange pdf-xchange_editor 10.3.1.387


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.1.387:*:*:*:*:*:*:*",
                     matchCriteriaId: "D0469A99-6E90-46A7-8698-77D7EB92D4C7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.1.387:*:*:*:*:*:*:*",
                     matchCriteriaId: "2198B487-C8B6-45E2-B12E-8F8DCB87334D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24835.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos TIF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24835.",
      },
   ],
   id: "CVE-2024-8846",
   lastModified: "2024-12-04T16:42:04.860",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:23.230",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1269/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 18:59
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25748.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-065/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "118C49BE-6894-4AC8-8792-80DC370C343E",
                     versionEndExcluding: "10.5.0.393",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25748.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto fuera de los límites en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una escritura más allá del final de un objeto asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-25748.",
      },
   ],
   id: "CVE-2025-0910",
   lastModified: "2025-02-12T18:59:18.447",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:35.633",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-065/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18658.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1380/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1380/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18658.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18658.",
      },
   ],
   id: "CVE-2022-42389",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.213",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1380/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1380/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:55
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24212.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1240/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24212.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto fuera de los límites en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una escritura más allá del final de un objeto asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24212.",
      },
   ],
   id: "CVE-2024-8817",
   lastModified: "2024-12-04T14:55:21.647",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:19.917",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1240/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:18
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24318.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1256/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24318.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto en el análisis de archivos XPS fuera de los límites en PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24318.",
      },
   ],
   id: "CVE-2024-8833",
   lastModified: "2024-11-29T20:18:39.087",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:21.753",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1256/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the saveAs method. The application exposes a JavaScript interface that allows the attacker to write arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-17527.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1093/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1093/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the saveAs method. The application exposes a JavaScript interface that allows the attacker to write arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-17527.",
      },
   ],
   id: "CVE-2022-37365",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.437",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1093/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1093/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-749",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17633.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1087/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1087/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17633.",
      },
   ],
   id: "CVE-2022-37359",
   lastModified: "2025-02-18T17:15:15.100",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.917",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1087/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1087/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-28 21:15
Modified
2025-02-19 16:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker Software may allow attackers to execute code when a user opens a crafted PDF file. The issue occurs when handling a large number of objects in a PDF file.
References
cve@mitre.orghttps://www.sit.fraunhofer.de/cve-2023-24308/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.sit.fraunhofer.de/cve-2023-24308/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "F824D120-B0D3-4407-B8EC-2AB81C8765C5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker Software may allow attackers to execute code when a user opens a crafted PDF file. The issue occurs when handling a large number of objects in a PDF file.",
      },
   ],
   id: "CVE-2023-24308",
   lastModified: "2025-02-19T16:15:36.167",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            type: "Secondary",
         },
      ],
   },
   published: "2023-03-28T21:15:10.710",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.sit.fraunhofer.de/cve-2023-24308/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.sit.fraunhofer.de/cve-2023-24308/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-755",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-755",
            },
         ],
         source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:47
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24217.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1245/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24217.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24217.",
      },
   ],
   id: "CVE-2024-8822",
   lastModified: "2024-12-04T14:47:30.647",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:20.470",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1245/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 19:00
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25433.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-067/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "64861956-D5A9-440A-AB6B-BB519B8E8839",
                     versionEndExcluding: "10.4.2.390",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25433.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos JB2 de editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JB2. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25433.",
      },
   ],
   id: "CVE-2025-0905",
   lastModified: "2025-02-12T19:00:08.500",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:34.997",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-067/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:20
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24314.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1252/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24314.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos EMF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos EMF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24314.",
      },
   ],
   id: "CVE-2024-8829",
   lastModified: "2024-11-29T20:20:01.307",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:21.290",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1252/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18660.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1382/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1382/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18660.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18660.",
      },
   ],
   id: "CVE-2022-42391",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.393",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1382/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1382/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18306.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1338/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1338/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18306.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JPC. Los datos manipulados en un archivo JPC pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18306.",
      },
   ],
   id: "CVE-2022-42411",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.830",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1338/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1338/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17628.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1082/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1082/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17628.",
      },
   ],
   id: "CVE-2022-37354",
   lastModified: "2025-02-18T17:15:14.403",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.500",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1082/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1082/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:55
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24209.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1237/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24209.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24209.",
      },
   ],
   id: "CVE-2024-8814",
   lastModified: "2024-12-04T14:55:59.677",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:19.590",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1237/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:55
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24211.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1239/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24211.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de Use-After-Free del análisis de archivos U3D en PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de validación de la existencia de un objeto antes de realizar operaciones en el objeto. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24211.",
      },
   ],
   id: "CVE-2024-8816",
   lastModified: "2024-12-04T14:55:51.693",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:19.803",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1239/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-04-01 22:15
Modified
2024-12-04 15:03
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22280.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-202/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-24-202/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.1.1.381
pdf-xchange pdf-xchange_editor 10.1.1.381


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "097CBCF4-A99C-4A83-937C-BE2F0A8E595F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "80367953-FC8D-4768-9BAC-4350A7E565C3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22280.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el componente EMF File Parsing de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el manejo de archivos EMF. El problema se debe a la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-22280.",
      },
   ],
   id: "CVE-2024-27328",
   lastModified: "2024-12-04T15:03:16.167",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-04-01T22:15:18.670",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-202/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-202/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:10
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24408.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1260/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24408.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto en el análisis de archivos XPS fuera de los límites en PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24408.",
      },
   ],
   id: "CVE-2024-8837",
   lastModified: "2024-11-29T20:10:41.130",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:22.210",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1260/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18342.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1349/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1349/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18342.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18342.",
      },
   ],
   id: "CVE-2022-41152",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.633",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1349/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1349/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 16:42
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25268.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1271/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.1.387
pdf-xchange pdf-xchange_editor 10.3.1.387


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.1.387:*:*:*:*:*:*:*",
                     matchCriteriaId: "D0469A99-6E90-46A7-8698-77D7EB92D4C7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.1.387:*:*:*:*:*:*:*",
                     matchCriteriaId: "2198B487-C8B6-45E2-B12E-8F8DCB87334D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25268.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en AcroForm del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el manejo de AcroForms. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25268.",
      },
   ],
   id: "CVE-2024-8848",
   lastModified: "2024-12-04T16:42:08.827",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:23.500",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1271/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-04-01 22:15
Modified
2024-12-04 15:05
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22275.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-203/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-24-203/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.1.1.381
pdf-xchange pdf-xchange_editor 10.1.1.381


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "097CBCF4-A99C-4A83-937C-BE2F0A8E595F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "80367953-FC8D-4768-9BAC-4350A7E565C3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22275.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el componente EMF File Parsing de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos EMF. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-22275.",
      },
   ],
   id: "CVE-2024-27325",
   lastModified: "2024-12-04T15:05:17.297",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-04-01T22:15:17.063",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-203/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-203/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18650.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1372/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1372/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18650.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18650.",
      },
   ],
   id: "CVE-2022-42381",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.617",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1372/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1372/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18630.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1367/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1367/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18630.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una condición de corrupción de la memoria. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18630.",
      },
   ],
   id: "CVE-2022-42377",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.340",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1367/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1367/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18286.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1337/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1337/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18286.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18286.",
      },
   ],
   id: "CVE-2022-41147",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.267",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1337/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1337/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17674.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1089/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1089/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17674.",
      },
   ],
   id: "CVE-2022-37361",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.090",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1089/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1089/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18283.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1335/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1335/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18283.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18283.",
      },
   ],
   id: "CVE-2022-41145",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.103",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1335/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1335/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2019-10-11 00:15
Modified
2024-11-27 20:11
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\192.168.0.2\C$\file.pdf without user interaction.
References
cve@mitre.orghttps://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdfThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdfThird Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "376E07A1-E3FB-491B-9C53-0BC6C68E825B",
                     versionEndExcluding: "8.0.330.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a related issue to CVE-2018-4993). For example, an NTLM hash is sent for a link to \\\\192.168.0.2\\C$\\file.pdf without user interaction.",
      },
      {
         lang: "es",
         value: "Tracker PDF-XChange Editor versiones anteriores a 8.0.330.0, presenta una vulnerabilidad de robo de hash NTLM SSO utilizando archivos FDF o XFDF diseñados (un problema relacionado con CVE-2018-4993). Por ejemplo, un hash NTLM es enviado hacia un enlace en \\\\192.168.0.2\\C$\\file.pdf sin interacción del usuario.",
      },
   ],
   id: "CVE-2019-17497",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-10-11T00:15:10.537",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdf",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/ponypot/cve/raw/master/pdfXChangeEditor_FDFInclusions.pdf",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-522",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-04-01 22:15
Modified
2024-12-04 15:03
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22277.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-205/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-24-205/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.1.1.381
pdf-xchange pdf-xchange_editor 10.1.1.381


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "097CBCF4-A99C-4A83-937C-BE2F0A8E595F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "80367953-FC8D-4768-9BAC-4350A7E565C3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22277.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución remota de código de escritura fuera de los límites en el componente PDF File Parsing de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. El problema se debe a la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-22277.",
      },
   ],
   id: "CVE-2024-27327",
   lastModified: "2024-12-04T15:03:46.113",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-04-01T22:15:18.120",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-205/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-205/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17728.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1096/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1096/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17728.",
      },
   ],
   id: "CVE-2022-37368",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.713",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1096/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1096/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. Crafted data in a PNG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17660.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1090/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1090/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. Crafted data in a PNG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17660.",
      },
   ],
   id: "CVE-2022-37362",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.177",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1090/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1090/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 19:00
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25422.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-071/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "64861956-D5A9-440A-AB6B-BB519B8E8839",
                     versionEndExcluding: "10.4.2.390",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25422.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos XPS del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25422.",
      },
   ],
   id: "CVE-2025-0904",
   lastModified: "2025-02-12T19:00:25.500",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:34.867",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-071/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18676.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1386/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1386/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18676.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. Los datos manipulados en un archivo TIF pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18676.",
      },
   ],
   id: "CVE-2022-42417",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:58.240",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1386/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1386/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:44
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24262.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1247/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24262.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos JB2 de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JB2. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24262.",
      },
   ],
   id: "CVE-2024-8824",
   lastModified: "2024-12-04T14:44:31.470",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:20.697",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1247/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18662.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1384/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1384/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18662.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18662.",
      },
   ],
   id: "CVE-2022-42393",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.537",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1384/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1384/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-04-01 22:15
Modified
2024-12-04 15:04
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22276.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-204/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-24-204/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.1.1.381
pdf-xchange pdf-xchange_editor 10.1.1.381


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "097CBCF4-A99C-4A83-937C-BE2F0A8E595F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "80367953-FC8D-4768-9BAC-4350A7E565C3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22276.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos XPS de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-22276.",
      },
   ],
   id: "CVE-2024-27326",
   lastModified: "2024-12-04T15:04:00.737",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-04-01T22:15:17.597",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-204/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-204/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18338.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1345/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1345/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18338.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18338.",
      },
   ],
   id: "CVE-2022-41148",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.340",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1345/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1345/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 16:38
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24553.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1268/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools *
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CCBDE41C-2363-4E7E-9F00-4401DF124C0F",
                     versionEndExcluding: "10.4.0.388",
                     versionStartIncluding: "10.3.0.386",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A461E260-0A49-4131-86AB-6E3754F00630",
                     versionEndExcluding: "10.4.0.388",
                     versionStartIncluding: "10.3.0.386",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24553.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos PDF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24553.",
      },
   ],
   id: "CVE-2024-8845",
   lastModified: "2024-12-04T16:38:07.607",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:23.110",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1268/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:50
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24214.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1242/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24214.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24214.",
      },
   ],
   id: "CVE-2024-8819",
   lastModified: "2024-12-04T14:50:28.667",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:20.133",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1242/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18529.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1363/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1363/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18529.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18529.",
      },
   ],
   id: "CVE-2022-42376",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.270",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1363/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1363/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18403.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1361/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1361/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18403.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema surge de la falta de validación de la existencia de un objeto antes de realizar operaciones sobre él. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18403.",
      },
   ],
   id: "CVE-2022-42374",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.133",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1361/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1361/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18068.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1102/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1102/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18068.",
      },
   ],
   id: "CVE-2022-37374",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:15.297",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1102/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1102/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 16:42
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25198.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1270/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.1.387
pdf-xchange pdf-xchange_editor 10.3.1.387


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.1.387:*:*:*:*:*:*:*",
                     matchCriteriaId: "D0469A99-6E90-46A7-8698-77D7EB92D4C7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.1.387:*:*:*:*:*:*:*",
                     matchCriteriaId: "2198B487-C8B6-45E2-B12E-8F8DCB87334D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25198.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto por lectura fuera de los límites de objetos Doc en el editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el manejo de objetos Doc. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-25198.",
      },
   ],
   id: "CVE-2024-8847",
   lastModified: "2024-12-04T16:42:07.103",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:23.367",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1270/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18345.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1352/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1352/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18345.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18345.",
      },
   ],
   id: "CVE-2022-42370",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.850",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1352/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1352/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17634.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1092/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1092/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17634.",
      },
   ],
   id: "CVE-2022-37364",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.347",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1092/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1092/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18700.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1389/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1389/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18700.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. Los datos manipulados en un archivo TIF pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18700.",
      },
   ],
   id: "CVE-2022-42419",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:58.380",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1389/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1389/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-01-07 18:15
Modified
2024-11-27 20:11
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.
References
cve@mitre.orghttps://pdf-insecurity.org/signature/evaluation_2018.htmlThird Party Advisory
cve@mitre.orghttps://pdf-insecurity.org/signature/signature.htmlThird Party Advisory
cve@mitre.orghttps://www.foxitsoftware.com/support/security-bulletins.phpVendor Advisory
cve@mitre.orghttps://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://pdf-insecurity.org/signature/evaluation_2018.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://pdf-insecurity.org/signature/signature.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.foxitsoftware.com/support/security-bulletins.phpVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/Third Party Advisory
Impacted products
Vendor Product Version
avanquest expert_pdf_ultimate 12.0.20
avanquest pdf_experte_ultimate 9.0.270
foxitsoftware foxit_reader 9.1.0
foxitsoftware foxit_reader 9.2.0.9297
foxitsoftware foxit_reader 9.3.0.10826
gonitro nitro_pro 11.0.3.173
gonitro nitro_reader 5.5.9.2
iskysoft pdf_editor_6 6.4.2.3521
iskysoft pdfelement6 6.8.0.3523
iskysoft pdfelement6 6.8.4.3921
pdf-xchange pdf-xchange_editor 7.0.237.1
pdf-xchange pdf-xchange_editor 7.0.326
pdfforge pdf_architect 6.0.37
pdfforge pdf_architect 6.1.24.1862
qoppa pdf_studio 12.0.7
qoppa pdf_studio_viewer_2018 2018.0.1
qoppa pdf_studio_viewer_2018 2018.2.0
sodapdf soda_pdf 9.3.17
sodapdf soda_pdf_desktop 10.2.09
sodapdf soda_pdf_desktop 10.2.16.1217
soft-xpansion perfect_pdf_10 10.0.0.1
soft-xpansion perfect_pdf_reader 13.0.3
soft-xpansion perfect_pdf_reader 13.1.5
tracker-software pdf-xchange_viewer 2.5
visagesoft expert_pdf_reader 9.0.180
microsoft windows -
foxitsoftware foxit_reader 9.1.0
foxitsoftware foxit_reader 9.2.0
iskysoft pdf_editor_6 6.6.2.3315
iskysoft pdf_editor_6 6.7.6.3399
iskysoft pdfelement6 6.7.1.3355
iskysoft pdfelement6 6.7.6.3399
qoppa pdf_studio 12.0.7
qoppa pdf_studio_viewer_2018 2018.0.1
qoppa pdf_studio_viewer_2018 2018.2.0
apple macos -
foxitsoftware foxit_reader 9.1.0
foxitsoftware foxit_reader 9.2.0
qoppa pdf_studio 12.0.7
qoppa pdf_studio_viewer_2018 2018.0.1
qoppa pdf_studio_viewer_2018 2018.2.0
linux linux_kernel -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:avanquest:expert_pdf_ultimate:12.0.20:*:*:*:*:*:*:*",
                     matchCriteriaId: "0998FDC0-7FC7-4A2C-993C-97BC76F27FBD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:avanquest:pdf_experte_ultimate:9.0.270:*:*:*:*:*:*:*",
                     matchCriteriaId: "CACE318F-ADDC-4B2F-8080-686C7430D12C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:foxitsoftware:foxit_reader:9.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "07844440-3F26-40E1-A747-4642FBA9A9FA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:foxitsoftware:foxit_reader:9.2.0.9297:*:*:*:*:*:*:*",
                     matchCriteriaId: "C0777020-4D36-4651-84D8-561767558118",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:foxitsoftware:foxit_reader:9.3.0.10826:*:*:*:*:*:*:*",
                     matchCriteriaId: "B5DFC3EB-168B-43C9-8C83-6FED38A2D3B2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gonitro:nitro_pro:11.0.3.173:*:*:*:*:*:*:*",
                     matchCriteriaId: "7DFA95E4-9780-4B0A-9996-95A257C8DE99",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:gonitro:nitro_reader:5.5.9.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "5B0A3796-4436-4706-A25C-04745B10D6DC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:iskysoft:pdf_editor_6:6.4.2.3521:*:*:*:professional:*:*:*",
                     matchCriteriaId: "9796785E-F5A4-4EB9-AE4C-3296449F0A27",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:iskysoft:pdfelement6:6.8.0.3523:*:*:*:professional:*:*:*",
                     matchCriteriaId: "C6FE27B0-5187-441A-8824-211838C71F3D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:iskysoft:pdfelement6:6.8.4.3921:*:*:*:professional:*:*:*",
                     matchCriteriaId: "950C35B2-1B7F-495F-9947-0E992329954B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:7.0.237.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "7E887CBD-BF50-4E3E-B44F-04B8FC5502B5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:7.0.326:*:*:*:*:*:*:*",
                     matchCriteriaId: "96BE2F3E-A319-4743-85C9-CF2653DDA258",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdfforge:pdf_architect:6.0.37:*:*:*:*:*:*:*",
                     matchCriteriaId: "8AD75B84-647C-46A1-8A6B-E667FDA0FB60",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdfforge:pdf_architect:6.1.24.1862:*:*:*:*:*:*:*",
                     matchCriteriaId: "33E48700-11CF-4992-8FD7-2A19620D36EA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:qoppa:pdf_studio:12.0.7:*:*:*:professional:*:*:*",
                     matchCriteriaId: "8944C809-795C-4F8F-A593-988B529F08B0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:qoppa:pdf_studio_viewer_2018:2018.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "F47F57CB-769C-4ED3-91A4-D6489A8DD432",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:qoppa:pdf_studio_viewer_2018:2018.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C0F12D65-A39B-4F36-A219-1AEDD968C9D9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:sodapdf:soda_pdf:9.3.17:*:*:*:*:*:*:*",
                     matchCriteriaId: "D234AC23-0D76-4D3F-9CF4-93966728C4CF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:sodapdf:soda_pdf_desktop:10.2.09:*:*:*:*:*:*:*",
                     matchCriteriaId: "96109777-AC81-4D51-ACEB-FDB3441A0D9F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:sodapdf:soda_pdf_desktop:10.2.16.1217:*:*:*:*:*:*:*",
                     matchCriteriaId: "A44A53AE-E8F0-4FAC-9942-F05D29E1B8CF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:soft-xpansion:perfect_pdf_10:10.0.0.1:*:*:*:premium:*:*:*",
                     matchCriteriaId: "F094FAF3-15CB-4481-9B86-61EABB82AAF6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:soft-xpansion:perfect_pdf_reader:13.0.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "A4F28BFA-F77A-4282-AA60-E25436AF98D1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:soft-xpansion:perfect_pdf_reader:13.1.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "E808A140-D375-4BE2-9EF1-4A17634ADAC2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:tracker-software:pdf-xchange_viewer:2.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "8B10625F-4F1D-4C00-AC17-ECBD4A6DEB32",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:visagesoft:expert_pdf_reader:9.0.180:*:*:*:*:*:*:*",
                     matchCriteriaId: "14B07BD4-0FC3-4471-B58B-2ADBA36B08D6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:foxitsoftware:foxit_reader:9.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "07844440-3F26-40E1-A747-4642FBA9A9FA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:foxitsoftware:foxit_reader:9.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "4B8E8F6D-8560-42D6-AED5-91D0570A4A13",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:iskysoft:pdf_editor_6:6.6.2.3315:*:*:*:professional:*:*:*",
                     matchCriteriaId: "80241CB1-3BC7-4572-92A4-E348C50FAE9A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:iskysoft:pdf_editor_6:6.7.6.3399:*:*:*:professional:*:*:*",
                     matchCriteriaId: "8336F6DF-0677-4AED-B062-0E7957A7A293",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:iskysoft:pdfelement6:6.7.1.3355:*:*:*:professional:*:*:*",
                     matchCriteriaId: "1D3941F4-B294-4E22-A6FF-CF3085DF6C89",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:iskysoft:pdfelement6:6.7.6.3399:*:*:*:professional:*:*:*",
                     matchCriteriaId: "1A3DB79B-12A7-4E55-9499-36EED6688382",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:qoppa:pdf_studio:12.0.7:*:*:*:professional:*:*:*",
                     matchCriteriaId: "8944C809-795C-4F8F-A593-988B529F08B0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:qoppa:pdf_studio_viewer_2018:2018.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "F47F57CB-769C-4ED3-91A4-D6489A8DD432",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:qoppa:pdf_studio_viewer_2018:2018.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C0F12D65-A39B-4F36-A219-1AEDD968C9D9",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "387021A0-AF36-463C-A605-32EA7DAC172E",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:foxitsoftware:foxit_reader:9.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "07844440-3F26-40E1-A747-4642FBA9A9FA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:foxitsoftware:foxit_reader:9.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "4B8E8F6D-8560-42D6-AED5-91D0570A4A13",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:qoppa:pdf_studio:12.0.7:*:*:*:professional:*:*:*",
                     matchCriteriaId: "8944C809-795C-4F8F-A593-988B529F08B0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:qoppa:pdf_studio_viewer_2018:2018.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "F47F57CB-769C-4ED3-91A4-D6489A8DD432",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:qoppa:pdf_studio_viewer_2018:2018.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C0F12D65-A39B-4F36-A219-1AEDD968C9D9",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected by the signature-validation logic. This affects Foxit Reader before 9.4 and PhantomPDF before 8.3.9 and 9.x before 9.4. It also affects eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer, Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF, and Soda PDF Desktop.",
      },
      {
         lang: "es",
         value: "La especificación Portable Document Format (PDF) no proporciona ninguna información sobre el procedimiento concreto de cómo comprobar las firmas. En consecuencia, se presenta una vulnerabilidad de Empaquetamiento de Firma en varios productos. Un atacante puede usar /ByteRange y manipulaciones xref que no son detectadas por la lógica de comprobación de firmas. Esto afecta a Foxit Reader versiones anteriores a 9.4 y PhantomPDF versiones anteriores a 8.3.9 y versiones 9.x anteriores a 9.4. También afecta a eXpert PDF 12 Ultimate, Expert PDF Reader, Nitro Pro, Nitro Reader, PDF Architect 6, PDF Editor 6 Pro, PDF Experte 9 Ultimate, PDFelement6 Pro, PDF Studio Viewer 2018, PDF Studio Pro, PDF-XChange Editor and Viewer , Perfect PDF 10 Premium, Perfect PDF Reader, Soda PDF y Soda PDF Desktop",
      },
   ],
   id: "CVE-2018-18689",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-01-07T18:15:12.560",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://pdf-insecurity.org/signature/evaluation_2018.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://pdf-insecurity.org/signature/signature.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.foxitsoftware.com/support/security-bulletins.php",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://pdf-insecurity.org/signature/evaluation_2018.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://pdf-insecurity.org/signature/signature.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.foxitsoftware.com/support/security-bulletins.php",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.pdfa.org/recently-identified-pdf-digital-signature-vulnerabilities/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-347",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18533.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1364/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1364/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18533.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. Los datos manipulados en un archivo PDF pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18533.",
      },
   ],
   id: "CVE-2022-42401",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.143",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1364/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1364/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 19:00
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25349.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-061/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A46B3522-2D44-4508-AF90-D7AD31B317AA",
                     versionEndExcluding: "10.4.1.389",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25349.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución remota de código de AcroForm en el editor PDF-XChange Use-After-Free. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en la gestión de AcroForms. El problema es el resultado de la falta de validación de la existencia de un objeto antes de realizar operaciones en el objeto. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-25349.",
      },
   ],
   id: "CVE-2025-0899",
   lastModified: "2025-02-12T19:00:59.227",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:34.347",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-061/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 19:00
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RTF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25421.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-070/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "64861956-D5A9-440A-AB6B-BB519B8E8839",
                     versionEndExcluding: "10.4.2.390",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor RTF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of RTF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25421.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución remota de código por desbordamiento de búfer basado en montón en el análisis de archivos RTF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos RTF. El problema es el resultado de la falta de una validación adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos a un búfer basado en montón de longitud fija. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-25421.",
      },
   ],
   id: "CVE-2025-0903",
   lastModified: "2025-02-12T19:00:43.213",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:34.737",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-070/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-122",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:08
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24305.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1249/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24305.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto en el análisis de archivos XPS fuera de los límites en PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24305.",
      },
   ],
   id: "CVE-2024-8826",
   lastModified: "2024-11-29T20:08:47.553",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:20.937",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1249/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 19:00
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25372.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-062/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A46B3522-2D44-4508-AF90-D7AD31B317AA",
                     versionEndExcluding: "10.4.1.389",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25372.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto por lectura fuera de los límites de objetos Doc en el editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en la gestión de objetos Doc. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-25372.",
      },
   ],
   id: "CVE-2025-0901",
   lastModified: "2025-02-12T19:00:52.577",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:34.480",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-062/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17727.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1094/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1094/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17727.",
      },
   ],
   id: "CVE-2022-37366",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.517",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1094/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1094/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:48
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24216.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1244/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24216.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de Use-After-Free del análisis de archivos U3D en PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de validación de la existencia de un objeto antes de realizar operaciones en el objeto. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24216.",
      },
   ],
   id: "CVE-2024-8821",
   lastModified: "2024-12-04T14:48:52.033",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:20.357",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1244/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18327.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1343/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1343/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18327.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. Los datos manipulados en un archivo PDF pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18327.",
      },
   ],
   id: "CVE-2022-42399",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.010",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1343/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1343/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:18
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24319.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1257/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24319.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos TIF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24319.",
      },
   ],
   id: "CVE-2024-8834",
   lastModified: "2024-11-29T20:18:18.010",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:21.863",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1257/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18324.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1341/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1341/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18324.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. Los datos manipulados en un archivo PDF pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18324.",
      },
   ],
   id: "CVE-2022-42412",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.900",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1341/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1341/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17772.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1099/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1099/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17772.",
      },
   ],
   id: "CVE-2022-37371",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:15.047",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1099/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1099/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:49
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24215.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1243/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24215.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24215.",
      },
   ],
   id: "CVE-2024-8820",
   lastModified: "2024-12-04T14:49:53.280",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:20.243",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1243/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18661.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1383/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1383/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18661.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18661.",
      },
   ],
   id: "CVE-2022-42392",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.467",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1383/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1383/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17637.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1081/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1081/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17637.",
      },
   ],
   id: "CVE-2022-37353",
   lastModified: "2025-02-18T17:15:14.270",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.373",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1081/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1081/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18657.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1379/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1379/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18657.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18657.",
      },
   ],
   id: "CVE-2022-42388",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.103",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1379/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1379/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18069.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1103/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1103/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18069.",
      },
   ],
   id: "CVE-2022-37375",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:15.470",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1103/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1103/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-03 22:06
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24409.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1261/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24409.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto en el análisis de archivos XPS fuera de los límites en PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24409.",
      },
   ],
   id: "CVE-2024-8838",
   lastModified: "2024-12-03T22:06:42.107",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:22.317",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1261/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 18:59
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25434.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-068/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "64861956-D5A9-440A-AB6B-BB519B8E8839",
                     versionEndExcluding: "10.4.2.390",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25434.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos JB2 de editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JB2. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25434.",
      },
   ],
   id: "CVE-2025-0906",
   lastModified: "2025-02-12T18:59:53.950",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:35.113",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-068/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 16:38
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24550.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1267/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools *
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CCBDE41C-2363-4E7E-9F00-4401DF124C0F",
                     versionEndExcluding: "10.4.0.388",
                     versionStartIncluding: "10.3.0.386",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A461E260-0A49-4131-86AB-6E3754F00630",
                     versionEndExcluding: "10.4.0.388",
                     versionStartIncluding: "10.3.0.386",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24550.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos PDF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24550.",
      },
   ],
   id: "CVE-2024-8844",
   lastModified: "2024-12-04T16:38:10.040",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:23.003",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1267/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17636.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1079/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1079/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. Crafted data in a J2K file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17636.",
      },
   ],
   id: "CVE-2022-37351",
   lastModified: "2025-02-18T17:15:13.997",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.200",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1079/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1079/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18339.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1346/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1346/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18339.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18339.",
      },
   ],
   id: "CVE-2022-41149",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.410",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1346/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1346/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18347.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1354/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1354/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18347.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18347.",
      },
   ],
   id: "CVE-2022-42372",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.990",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1354/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1354/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 18:59
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25678.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-064/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "118C49BE-6894-4AC8-8792-80DC370C343E",
                     versionEndExcluding: "10.5.0.393",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25678.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos XPS del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25678.",
      },
   ],
   id: "CVE-2025-0909",
   lastModified: "2025-02-12T18:59:31.043",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:35.500",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-064/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-04-01 22:15
Modified
2024-12-03 22:03
Severity ?
7.5 (High) - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this vulnerability. The specific flaw exists within the update functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22224.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-198/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-24-198/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.1.1.381
pdf-xchange pdf-xchange_editor 10.1.1.381


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "097CBCF4-A99C-4A83-937C-BE2F0A8E595F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "80367953-FC8D-4768-9BAC-4350A7E565C3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this vulnerability.\n\nThe specific flaw exists within the update functionality. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22224.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución remota de código de validación de certificado incorrecta de PDF-XChange Editor Updater. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. No se requiere la interacción del usuario para aprovechar esta vulnerabilidad. La falla específica existe dentro de la funcionalidad de actualización. El problema se debe a la falta de validación adecuada del certificado presentado por el servidor. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del usuario actual. Era ZDI-CAN-22224.",
      },
   ],
   id: "CVE-2024-27323",
   lastModified: "2024-12-03T22:03:36.550",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "ADJACENT_NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.6,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "ADJACENT_NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.6,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-04-01T22:15:15.950",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-198/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-198/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-295",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-295",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18652.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1374/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1374/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18652.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18652.",
      },
   ],
   id: "CVE-2022-42383",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.760",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1374/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1374/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Collab objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17144.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1078/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1078/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Collab objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17144.",
      },
   ],
   id: "CVE-2022-37350",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.113",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1078/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1078/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18368.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1358/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1358/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18368.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JP2. Los datos manipulados en un archivo JP2 pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18368.",
      },
   ],
   id: "CVE-2022-42413",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.970",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1358/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1358/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:56
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24208.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1236/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24208.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto fuera de los límites en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una escritura más allá del final de un objeto asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24208.",
      },
   ],
   id: "CVE-2024-8813",
   lastModified: "2024-12-04T14:56:03.620",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:19.473",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1236/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18402.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1360/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1360/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18402.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18402.",
      },
   ],
   id: "CVE-2022-42373",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.060",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1360/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1360/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:19
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24315.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1253/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24315.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto fuera de los límites en el análisis de archivos XPS del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24315.",
      },
   ],
   id: "CVE-2024-8830",
   lastModified: "2024-11-29T20:19:22.237",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:21.410",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1253/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WMF files. Crafted data in a WMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17638.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1080/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1080/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of WMF files. Crafted data in a WMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17638.",
      },
   ],
   id: "CVE-2022-37352",
   lastModified: "2025-02-18T17:15:14.133",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.293",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1080/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1080/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18366.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1356/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1356/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18366.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JP2. Los datos manipulados en un archivo JP2 pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18366.",
      },
   ],
   id: "CVE-2022-42415",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:58.107",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1356/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1356/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18673.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1385/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1385/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18673.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. Los datos manipulados en un archivo TIF pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18673.",
      },
   ],
   id: "CVE-2022-42416",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:58.173",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1385/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1385/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 16:38
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24495.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1266/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools *
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CCBDE41C-2363-4E7E-9F00-4401DF124C0F",
                     versionEndExcluding: "10.4.0.388",
                     versionStartIncluding: "10.3.0.386",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A461E260-0A49-4131-86AB-6E3754F00630",
                     versionEndExcluding: "10.4.0.388",
                     versionStartIncluding: "10.3.0.386",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24495.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos JB2 de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JB2. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24495.",
      },
   ],
   id: "CVE-2024-8843",
   lastModified: "2024-12-04T16:38:13.297",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:22.887",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1266/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18651.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1373/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1373/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18651.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18651.",
      },
   ],
   id: "CVE-2022-42382",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.690",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1373/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1373/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:55
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24213.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1241/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24213.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución remota de código después de la liberación del análisis de archivos U3D en PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de validación de la existencia de un objeto antes de realizar operaciones en el objeto. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24213.",
      },
   ],
   id: "CVE-2024-8818",
   lastModified: "2024-12-04T14:55:10.590",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:20.027",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1241/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 19:00
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25405.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-072/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "64861956-D5A9-440A-AB6B-BB519B8E8839",
                     versionEndExcluding: "10.4.2.390",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25405.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos XPS del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25405.",
      },
   ],
   id: "CVE-2025-0902",
   lastModified: "2025-02-12T19:00:34.533",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:34.610",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-072/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18341.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1348/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1348/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18341.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18341.",
      },
   ],
   id: "CVE-2022-41151",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.560",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1348/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1348/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18282.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1334/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1334/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18282.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18282.",
      },
   ],
   id: "CVE-2022-41144",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.030",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1334/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1334/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18340.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1347/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1347/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18340.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18340.",
      },
   ],
   id: "CVE-2022-41150",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.483",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1347/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1347/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18543.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1366/Press/Media Coverage, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1366/Press/Media Coverage, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18543.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos EMF. El problema surge de la falta de validación de la existencia de un objeto antes de realizar operaciones sobre él. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18543.",
      },
   ],
   id: "CVE-2022-42408",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.623",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1366/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1366/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:20
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24263.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1248/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24263.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto en el análisis de archivos PDF fuera de los límites en el editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24263.",
      },
   ],
   id: "CVE-2024-8825",
   lastModified: "2024-11-29T20:20:44.863",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:20.817",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1248/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18326.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1342/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1342/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18326.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. El problema surge de la falta de validación de la existencia de un objeto antes de realizar operaciones sobre él. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18326.",
      },
   ],
   id: "CVE-2022-42414",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:58.037",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1342/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1342/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-416",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18656.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1378/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1378/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18656.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18656.",
      },
   ],
   id: "CVE-2022-42387",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.037",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1378/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1378/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:42
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-24420.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1263/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-24420.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto en el análisis de archivos JB2 del editor PDF-XChange que no se encuentra dentro de los límites de lectura. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JB2. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. . Era ZDI-CAN-24420.",
      },
   ],
   id: "CVE-2024-8840",
   lastModified: "2024-12-04T14:42:12.897",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:22.537",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1263/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18677.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1387/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1387/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18677.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. El problema se debe a la falta de validación adecuada de un valor proporcionado por el usuario antes de eliminar la referencia a él como puntero. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18677.",
      },
   ],
   id: "CVE-2022-42418",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:58.307",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1387/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1387/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-822",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. Crafted data in an ICO file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17631.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1085/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1085/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICO files. Crafted data in an ICO file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17631.",
      },
   ],
   id: "CVE-2022-37357",
   lastModified: "2025-02-18T17:15:14.820",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.760",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1085/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1085/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17810.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1101/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1101/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17810.",
      },
   ],
   id: "CVE-2022-37373",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:15.207",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1101/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1101/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18686.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1388/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1388/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18686.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. Los datos manipulados en un archivo TIF pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18686.",
      },
   ],
   id: "CVE-2022-42420",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:58.450",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1388/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1388/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18279.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1333/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1333/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18279.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. Los datos manipulados en un archivo XPS pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18279.",
      },
   ],
   id: "CVE-2022-42397",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.870",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1333/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1333/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2018-09-01 14:29
Modified
2024-11-27 20:11
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564.
References
cve@mitre.orghttps://forum.tracker-software.com/viewtopic.php?f=62&t=31419Exploit, Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://forum.tracker-software.com/viewtopic.php?f=62&t=31419Exploit, Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "482A6952-AB23-4BAB-B018-578559B69C4A",
                     versionEndIncluding: "7.0.326.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor through 7.0.326.1 allows remote attackers to cause a denial of service (resource consumption) via a crafted x:xmpmeta structure, a related issue to CVE-2003-1564.",
      },
      {
         lang: "es",
         value: "PDF-XChange Editor hasta la versión 7.0.326.1 permite que atacantes remotos provoquen una denegación de servicio (consumo de recursos) mediante una estructura x:xmpmeta manipulada. Esto está relacionado con CVE-2003-1564.",
      },
   ],
   id: "CVE-2018-16303",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-09-01T14:29:00.387",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://forum.tracker-software.com/viewtopic.php?f=62&t=31419",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://forum.tracker-software.com/viewtopic.php?f=62&t=31419",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-611",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:55
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24210.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1238/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24210.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución remota de código por corrupción de memoria en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una condición de corrupción de memoria. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24210.",
      },
   ],
   id: "CVE-2024-8815",
   lastModified: "2024-12-04T14:55:55.787",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:19.697",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1238/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18273.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1330/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1330/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18273.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos EMF. Los datos manipulados en un archivo EMF pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18273.",
      },
   ],
   id: "CVE-2022-42404",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.350",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1330/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1330/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18653.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1375/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1375/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18653.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18653.",
      },
   ],
   id: "CVE-2022-42384",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.827",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1375/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1375/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18703.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1393/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1393/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18703.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. Los datos manipulados en un archivo TIF pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18703.",
      },
   ],
   id: "CVE-2022-42421",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:58.517",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1393/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1393/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17629.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1083/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1083/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17629.",
      },
   ],
   id: "CVE-2022-37355",
   lastModified: "2025-02-18T17:15:14.543",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.593",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1083/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1083/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17724.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1097/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1097/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17724.",
      },
   ],
   id: "CVE-2022-37369",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.857",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1097/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1097/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18648.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1370/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1370/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18648.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18648.",
      },
   ],
   id: "CVE-2022-42379",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.477",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1370/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1370/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 19:00
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25957.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-066/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "118C49BE-6894-4AC8-8792-80DC370C343E",
                     versionEndExcluding: "10.5.0.393",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25957.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25957.",
      },
   ],
   id: "CVE-2025-0911",
   lastModified: "2025-02-12T19:00:17.000",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:35.770",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-066/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. Crafted data in an AcroForm can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17726.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1095/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1095/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of AcroForms. Crafted data in an AcroForm can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17726.",
      },
   ],
   id: "CVE-2022-37367",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.600",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1095/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1095/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 18:59
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25557.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-063/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "64861956-D5A9-440A-AB6B-BB519B8E8839",
                     versionEndExcluding: "10.4.2.390",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25557.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos U3D del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25557.",
      },
   ],
   id: "CVE-2025-0908",
   lastModified: "2025-02-12T18:59:38.310",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:35.370",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-063/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18346.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1353/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1353/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18346.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18346.",
      },
   ],
   id: "CVE-2022-42371",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.920",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1353/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1353/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:19
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24316.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1254/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. \n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24316.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto en el análisis de archivos XPS fuera de los límites en PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24316.",
      },
   ],
   id: "CVE-2024-8831",
   lastModified: "2024-11-29T20:19:09.460",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:21.530",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1254/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18278.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1332/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1332/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18278.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema se debe a la falta de validación adecuada de un valor proporcionado por el usuario antes de eliminar la referencia a él como puntero. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18278.",
      },
   ],
   id: "CVE-2022-42396",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.797",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1332/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1332/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-822",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-119",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18225.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1329/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1329/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18225.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18225.",
      },
   ],
   id: "CVE-2022-41143",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:53.953",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1329/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1329/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18893.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1392/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1392/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18893.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18893.",
      },
   ],
   id: "CVE-2022-42394",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.630",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1392/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1392/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18307.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1339/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1339/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18307.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. Los datos manipulados en un archivo PDF pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18307.",
      },
   ],
   id: "CVE-2022-42398",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:56.940",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1339/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1339/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18654.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1376/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1376/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18654.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18654.",
      },
   ],
   id: "CVE-2022-42385",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.897",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1376/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1376/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18892.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1391/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1391/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18892.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. El problema se debe a la falta de una validación adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos en un búfer basado en almacenamiento dinámico de longitud fija. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18892.",
      },
   ],
   id: "CVE-2022-42403",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.277",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1391/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1391/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-122",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18315.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1340/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1340/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18315.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. Los datos manipulados en un archivo PDF pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18315.",
      },
   ],
   id: "CVE-2022-42409",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.690",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1340/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1340/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2025-02-11 20:15
Modified
2025-02-12 18:59
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25435.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-25-069/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "64861956-D5A9-440A-AB6B-BB519B8E8839",
                     versionEndExcluding: "10.4.2.390",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25435.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos JB2 de editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JB2. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-25435.",
      },
   ],
   id: "CVE-2025-0907",
   lastModified: "2025-02-12T18:59:44.813",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2025-02-11T20:15:35.240",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-25-069/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18343.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1350/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1350/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18343.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18343.",
      },
   ],
   id: "CVE-2022-41153",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.707",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1350/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1350/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17632.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1086/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1086/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17632.",
      },
   ],
   id: "CVE-2022-37358",
   lastModified: "2025-02-18T17:15:14.957",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:13.833",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1086/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1086/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18542.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1365/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1365/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18542.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos EMF. Los datos manipulados en un archivo EMF pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18542.",
      },
   ],
   id: "CVE-2022-42407",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.557",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1365/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1365/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in an embedded U3D object can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18632.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1369/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1369/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in an embedded U3D object can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18632.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. Los datos manipulados en un objeto U3D incrustado pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18632.",
      },
   ],
   id: "CVE-2022-42402",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.210",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1369/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1369/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-04-01 22:15
Modified
2024-12-04 15:02
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22285.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-200/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-24-200/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.1.1.381
pdf-xchange pdf-xchange_editor 10.1.1.381


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "097CBCF4-A99C-4A83-937C-BE2F0A8E595F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.1.1.381:*:*:*:*:*:*:*",
                     matchCriteriaId: "80367953-FC8D-4768-9BAC-4350A7E565C3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22285.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el componente XPS File Parsing de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos XPS. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-22285.",
      },
   ],
   id: "CVE-2024-27329",
   lastModified: "2024-12-04T15:02:57.010",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-04-01T22:15:19.193",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-200/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-200/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17809.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1100/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1100/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17809.",
      },
   ],
   id: "CVE-2022-37372",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:15.117",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1100/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1100/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2025-02-18 17:15
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17635.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1088/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1088/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17635.",
      },
   ],
   id: "CVE-2022-37360",
   lastModified: "2025-02-18T17:15:15.240",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.010",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1088/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1088/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:41
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24432.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1264/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24432.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos PDF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24432.",
      },
   ],
   id: "CVE-2024-8841",
   lastModified: "2024-12-04T14:41:07.097",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:22.657",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1264/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17725.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1098/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1098/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-17725.",
      },
   ],
   id: "CVE-2022-37370",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.957",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1098/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1098/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-03-29 19:15
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17673.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1091/Release Notes, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyRelease Notes
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1091/Release Notes, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor 9.3.361.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:9.3.361.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B2868B-DC97-4D56-977D-3E755285DAAD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. Crafted data in an EMF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17673.",
      },
   ],
   id: "CVE-2022-37363",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-29T19:15:14.263",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1091/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1091/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:17
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24320.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1258/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated  object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24320.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos JB2 de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JB2. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24320.",
      },
   ],
   id: "CVE-2024-8835",
   lastModified: "2024-11-29T20:17:52.063",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:21.983",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1258/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-11-29 20:17
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24354.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1259/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24354.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos TIF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24354.",
      },
   ],
   id: "CVE-2024-8836",
   lastModified: "2024-11-29T20:17:29.823",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:22.103",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1259/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PGM files. Crafted data in a PGM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18365.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1355/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1355/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PGM files. Crafted data in a PGM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18365.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PGM. Los datos manipulados en un archivo PGM pueden desencadenar una escritura más allá del final de un búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-18365.",
      },
   ],
   id: "CVE-2022-42410",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:57.760",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1355/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1355/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:45
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24261.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1246/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools 10.3.0.386
pdf-xchange pdf-xchange_editor 10.3.0.386


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "C93EFAC4-4B02-41B1-A788-0A7FC98CD499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:10.3.0.386:*:*:*:*:*:*:*",
                     matchCriteriaId: "207FF12C-548C-425F-9474-61148DBE69C2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-24261.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el análisis de archivos JB2 de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos divulgar información confidencial sobre instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos JB2. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-24261.",
      },
   ],
   id: "CVE-2024-8823",
   lastModified: "2024-12-04T14:45:59.687",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:20.583",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1246/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18655.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1377/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1377/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18655.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos manipulados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18655.",
      },
   ],
   id: "CVE-2022-42386",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:55.967",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1377/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1377/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 21:15
Modified
2024-12-04 14:38
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RTF files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24481.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1265/Third Party Advisory
Impacted products
Vendor Product Version
pdf-xchange pdf-tools *
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CCBDE41C-2363-4E7E-9F00-4401DF124C0F",
                     versionEndExcluding: "10.4.0.388",
                     versionStartIncluding: "10.3.0.386",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A461E260-0A49-4131-86AB-6E3754F00630",
                     versionEndExcluding: "10.4.0.388",
                     versionStartIncluding: "10.3.0.386",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of RTF files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24481.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución remota de código en variables no inicializadas al analizar archivos RTF en PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos RTF. El problema es el resultado de la falta de inicialización adecuada de la memoria antes de acceder a ella. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-24481.",
      },
   ],
   id: "CVE-2024-8842",
   lastModified: "2024-12-04T14:38:40.640",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T21:15:22.770",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1265/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-457",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-908",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-04-01 22:15
Modified
2024-12-04 15:10
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22270.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-196/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-24-196/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-tools *
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-tools:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F542767E-1272-45B6-ACFE-19AA63A3AFE0",
                     versionEndExcluding: "10.1.3.383",
                     versionStartIncluding: "10.1.1.381",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A6D3A4A7-5483-42FA-A725-0CEFD57982CE",
                     versionEndExcluding: "10.1.3.383",
                     versionStartIncluding: "10.1.1.381",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22270.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de divulgación de información de lectura fuera de los límites en el componente TIF File Parsing de PDF-XChange Editor. Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos TIF. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del final de un objeto asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-22270.",
      },
   ],
   id: "CVE-2024-27324",
   lastModified: "2024-12-04T15:10:48.827",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-04-01T22:15:16.503",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-196/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-196/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-11-22 22:15
Modified
2024-11-26 20:58
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23550.
References
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-24-1037/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "513B6750-2B2F-445B-9F15-0CE1FB487192",
                     versionEndIncluding: "10.3.0.385",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23550.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de ejecución de código remoto fuera de los límites en el análisis de archivos PDF del editor PDF-XChange. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del editor PDF-XChange. Se requiere la interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos PDF. El problema es el resultado de la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una escritura más allá del final de un objeto asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-23550.",
      },
   ],
   id: "CVE-2024-7352",
   lastModified: "2024-11-26T20:58:09.063",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-11-22T22:15:17.780",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-24-1037/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-01-26 18:59
Modified
2024-11-27 20:11
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Summary
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18284.
References
zdi-disclosures@trendmicro.comhttps://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
zdi-disclosures@trendmicro.comhttps://www.zerodayinitiative.com/advisories/ZDI-22-1336/Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.zerodayinitiative.com/advisories/ZDI-22-1336/Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
pdf-xchange pdf-xchange_editor *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:pdf-xchange:pdf-xchange_editor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE9DD26D-B14E-4EB3-8698-3E0E82F2177A",
                     versionEndExcluding: "9.5.366.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18284.",
      },
      {
         lang: "es",
         value: "Esta vulnerabilidad permite a atacantes remotos revelar información confidencial sobre las instalaciones afectadas de PDF-XChange Editor. Se requiere la interacción del usuario para aprovechar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica existe en el análisis de archivos U3D. Los datos elaborados en un archivo U3D pueden desencadenar una lectura más allá del final de un búfer asignado. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto del proceso actual. Era ZDI-CAN-18284.",
      },
   ],
   id: "CVE-2022-41146",
   lastModified: "2024-11-27T20:11:45.410",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "zdi-disclosures@trendmicro.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-01-26T18:59:54.173",
   references: [
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "zdi-disclosures@trendmicro.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1336/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.tracker-software.com/product/pdf-xchange-editor/history",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.zerodayinitiative.com/advisories/ZDI-22-1336/",
      },
   ],
   sourceIdentifier: "zdi-disclosures@trendmicro.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "zdi-disclosures@trendmicro.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-125",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}