CVE-2023-39490: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains a remote code execution vulnerability (CVE-2023-39490) discovered in January 2023 and disclosed on August 17, 2023. The vulnerability affects the PDF file parsing functionality in PDF-XChange Editor installations. The issue was assigned a CVSS v3.0 score of 7.8 (High severity) (ZDI Advisory).

The vulnerability exists within the parsing of PDF files where crafted data can trigger a write past the end of an allocated buffer (out-of-bounds write). The flaw is classified as CWE-787 (Out-of-bounds Write). User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file (ZDI Advisory).

An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process on affected installations of PDF-XChange Editor. Given the user interaction requirement and local access vector, successful exploitation could lead to complete compromise of the affected system (ZDI Advisory).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requires no privileges, but does need user interaction according to the CVSS metrics (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor V9 (version 9.5.368) and V10 (version 10.0.1). Users should upgrade to these patched versions to mitigate the vulnerability (ZDI Advisory).