CVE-2023-32158: 
PDF-XChange Editor vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2023-32158) was discovered in PDF-XChange Editor. The vulnerability was reported on May 17, 2023, and affects installations of PDF-XChange Editor. The vulnerability requires user interaction, specifically opening a malicious PDF file, to be exploited (ZDI Advisory).

The vulnerability exists within the parsing of PDF files. When parsing PDF files, a crafted data input can trigger a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating a high severity level (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. This could potentially lead to complete system compromise within the scope of the affected application's privileges (ZDI Advisory).

The vulnerability requires user interaction to be exploited. An attacker would need to convince a target to visit a malicious page or open a malicious PDF file. Once the malicious file is opened, the vulnerability can be triggered through crafted data in the PDF file (ZDI Advisory).

PDF-XChange has released an update to address this vulnerability. Users are advised to update to the latest version of PDF-XChange Editor to protect against this vulnerability (ZDI Advisory).