CVE-2022-37364: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2022-37364 is a vulnerability affecting PDF-XChange Editor that was discovered and disclosed in 2022. The vulnerability was reported to the vendor on June 10, 2022, and publicly disclosed on August 18, 2022. This security flaw affects PDF-XChange Editor version 9.3.361.0 and allows remote attackers to execute arbitrary code on affected installations (ZDI Advisory).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) that occurs within the parsing of EMF files. When parsing EMF files, crafted data can trigger a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD, ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score indicates severe potential impacts on confidentiality, integrity, and availability of the affected system (ZDI Advisory).

PDF-XChange has issued an update to correct this vulnerability. Users are advised to update to the latest version of the software to mitigate this security risk (ZDI Advisory, Software History).