CVE-2022-37372: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2022-37372 is a remote code execution vulnerability affecting PDF-XChange Editor. The vulnerability was discovered and reported to the vendor on July 19, 2022, and publicly disclosed on August 18, 2022. The vulnerability affects PDF-XChange Editor version 9.3.361.0 and allows remote attackers to execute arbitrary code on affected installations (Zero Day Initiative).

The vulnerability exists within the parsing of PDF files, where crafted data in a PDF file can trigger a write past the end of an allocated buffer (out-of-bounds write). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-787 (Out-of-bounds Write) (Zero Day Initiative, NVD).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (Zero Day Initiative).

PDF-XChange has issued an update to correct this vulnerability. Users are advised to update to the latest version of the software (Tracker Software).