CVE-2022-42388: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contained a vulnerability related to U3D file parsing that could lead to an out-of-bounds read information disclosure. The vulnerability was assigned CVE-2022-42388 and was discovered in 2022 (ZDI Advisory).

The vulnerability exists within the parsing of U3D files in PDF-XChange Editor. When parsing U3D files, crafted data can trigger a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), indicating a relatively low severity (ZDI Advisory).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. The impact is limited to information disclosure, as the vulnerability itself cannot directly lead to code execution. However, an attacker could potentially leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

PDF-XChange has issued an update to correct this vulnerability. Users should update to the latest version of PDF-XChange Editor to protect against this vulnerability (ZDI Advisory).