CVE-2022-42391: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2022-42391 is a vulnerability discovered in PDF-XChange Editor that allows remote attackers to disclose sensitive information on affected installations. The vulnerability was reported on September 6, 2022, and publicly disclosed on October 7, 2022. The vulnerability specifically affects the parsing of U3D files in PDF-XChange Editor (ZDI Advisory).

The vulnerability is classified as an out-of-bounds read information disclosure vulnerability. The specific flaw exists within the parsing of U3D files, where crafted data can trigger a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), indicating a relatively low severity (ZDI Advisory).

When exploited, this vulnerability can lead to the disclosure of sensitive information from the affected system. An attacker could potentially leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

PDF-XChange has issued an update to correct this vulnerability. Users are advised to update to the latest version of PDF-XChange Editor (ZDI Advisory).