CVE-2022-42385: 
PDF-XChange Editor vulnerability analysis and mitigation

The vulnerability (CVE-2022-42385) affects PDF-XChange Editor and involves an out-of-bounds read information disclosure vulnerability in U3D file parsing. The vulnerability was discovered and reported on September 6, 2022, with public disclosure following on October 7, 2022 (ZDI Advisory).

The vulnerability exists within the parsing of U3D files in PDF-XChange Editor. When processing crafted data in a U3D file, it can trigger a read past the end of an allocated buffer, potentially leading to information disclosure. The vulnerability has been assigned a CVSS v3.1 score of 3.3 (Low) with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (ZDI Advisory).

The vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. The impact is limited to information disclosure, with no direct impact on system integrity or availability (ZDI Advisory).

PDF-XChange has released an update to address this vulnerability. Users are advised to update to the latest version of PDF-XChange Editor (ZDI Advisory, PDF-XChange History).