CVE-2023-39483: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains an information disclosure vulnerability in the parsing of J2K files. The vulnerability (CVE-2023-39483) was discovered on August 23, 2022 and publicly disclosed on August 17, 2023. It affects PDF-XChange Editor installations and requires user interaction to exploit (ZDI Advisory).

The vulnerability exists within the J2K file parsing functionality. When processing crafted data in a J2K file, it can trigger a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 3.3 (Low) with the vector: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (ZDI Advisory).

An attacker can leverage this vulnerability to disclose sensitive information from the affected system. While the direct impact is limited to information disclosure, it could potentially be combined with other vulnerabilities to achieve arbitrary code execution in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requires no privileges, but does need user interaction (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor V9 (9.5.368) and V10 (10.0.1). Users should update to these or later versions to mitigate the vulnerability (ZDI Advisory).