CVE-2022-42408: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2022-42408 is a use-after-free vulnerability affecting PDF-XChange Editor that allows remote attackers to disclose sensitive information. The vulnerability was discovered and reported on September 20, 2022, with a coordinated public release on October 7, 2022 (ZDI Advisory).

The vulnerability exists within the parsing of EMF files in PDF-XChange Editor. The specific flaw results from the lack of validating the existence of an object prior to performing operations on the object. The vulnerability has been assigned a CVSS score of 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), indicating a low severity level (ZDI Advisory).

When successfully exploited, this vulnerability allows attackers to disclose sensitive information on affected installations of PDF-XChange Editor. The vulnerability can potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

PDF-XChange has released a security update to address this vulnerability. Users are advised to update to the latest version of PDF-XChange Editor (ZDI Advisory, Tracker Software).