CVE-2023-39492: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains a heap-based buffer overflow vulnerability (CVE-2023-39492) that allows remote attackers to execute arbitrary code. The vulnerability was discovered on December 29, 2022, and publicly disclosed on August 17, 2023. The issue affects PDF-XChange Editor installations and requires user interaction, specifically opening a malicious file or visiting a malicious page (Zero Day Initiative).

The vulnerability exists within the parsing of PDF files and results from the lack of proper validation of the length of user-supplied data before copying it to a fixed-length heap-based buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue has been classified as CWE-122 (Heap-based Buffer Overflow) (Zero Day Initiative, NVD).

A successful exploitation of this vulnerability allows attackers to execute arbitrary code in the context of the current process. This could potentially lead to complete system compromise if the application is running with elevated privileges (Zero Day Initiative).

The vulnerability requires user interaction for exploitation, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges and only basic user interaction (Zero Day Initiative).

The vulnerability has been fixed in PDF-XChange Editor V9 (9.5.368) and V10 (10.0.1). Users are advised to update to these versions or later to mitigate the vulnerability (Zero Day Initiative).