CVE-2023-39485: 
PDF-XChange Editor vulnerability analysis and mitigation

The vulnerability (CVE-2023-39485) affects PDF-XChange Editor and was disclosed on August 17, 2023. This is an Out-Of-Bounds Write Remote Code Execution vulnerability that exists within the parsing of JP2 files in PDF-XChange Editor (ZDI Advisory).

The specific flaw exists within the parsing of JP2 files. When processing crafted data in a JP2 file, it can trigger a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, no privileges required, and user interaction required (ZDI Advisory).

An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. This could lead to complete compromise of the affected system with the same privileges as the application (ZDI Advisory).

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor V9 (9.5.368) and V10 (10.0.1). Users should update to these or later versions to mitigate the vulnerability (ZDI Advisory).