CVE-2022-37353: 
PDF-XChange Editor vulnerability analysis and mitigation

A vulnerability identified as CVE-2022-37353 affects PDF-XChange Editor installations. The vulnerability was discovered and reported through the Zero Day Initiative (ZDI-CAN-17637). This security flaw involves the parsing of EMF files and was disclosed on August 18, 2022 (Zero Day Initiative).

The vulnerability exists within the parsing of EMF files in PDF-XChange Editor. When processing EMF files, the application can trigger a read past the end of an allocated buffer, leading to an out-of-bounds read condition (CWE-125). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

The vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. The impact is primarily focused on data confidentiality, with no direct impact on system integrity or availability (Zero Day Initiative).

PDF-XChange has released an update to address this vulnerability. Users are advised to update their PDF-XChange Editor installations to the latest version available through the official website (Tracker Software).