CVE-2023-27340: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains a remote code execution vulnerability (CVE-2023-27340) related to PNG file parsing. The vulnerability was discovered by Rocco Calvi (@TecR0c) from TecSecurity and was reported to the vendor on September 28, 2022, with public disclosure occurring on March 31, 2023 (Zero Day Initiative).

The vulnerability exists within the parsing of PNG files in PDF-XChange Editor. Specifically, crafted data in a PNG file can trigger a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Zero Day Initiative).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score indicates that successful exploitation could lead to complete compromise of the affected system's confidentiality, integrity, and availability (Zero Day Initiative).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, and no privileges are required to execute the attack (Zero Day Initiative).

PDF-XChange has released an update to address this vulnerability. Users are advised to update to the latest version of the software (Software History).