CVE-2022-42390: 
PDF-XChange Editor vulnerability analysis and mitigation

A vulnerability was discovered in PDF-XChange Editor affecting the parsing of U3D files. The vulnerability, identified as CVE-2022-42390, allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. The issue was reported on September 6, 2022, and publicly disclosed on October 7, 2022 (ZDI Advisory).

The vulnerability is classified as an out-of-bounds read information disclosure issue. The specific flaw exists within the parsing of U3D files, where crafted data can trigger a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), indicating a relatively low severity (ZDI Advisory).

When exploited, this vulnerability can lead to the disclosure of sensitive information. An attacker could potentially leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

PDF-XChange has issued an update to correct this vulnerability. Users are advised to update to the latest version of PDF-XChange Editor (ZDI Advisory).