PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Rocco Calvi

ZDI ID: ZDI-23-1360
ZDI-CAN: ZDI-CAN-20889
CVE
CVE-2023-42044
CVSS
7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Vendors
PDF-XChange
Affected Products
PDF-XChange Editor

Vulnerability Details

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Additional Details

Disclosure Timeline

  • 2023-04-28 — Vulnerability reported to vendor
  • 2023-09-08 — Coordinated public release of advisory