CVE-2023-39497: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains a remote code execution vulnerability (CVE-2023-39497) discovered in January 2023. The vulnerability exists within the parsing of JPG files and was disclosed publicly on August 17, 2023. The issue affects PDF-XChange Editor installations and requires user interaction, such as visiting a malicious page or opening a malicious file (Zero Day Initiative).

The vulnerability stems from improper validation of user-supplied data during JPG file parsing, which can result in a write past the end of an allocated object. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (HIGH) with the vector string: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The flaw is tracked as ZDI-CAN-19947 (Zero Day Initiative).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score indicates severe potential impacts on system confidentiality, integrity, and availability (Zero Day Initiative).

Exploitation requires user interaction, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges, but does need user interaction to trigger the vulnerability (Zero Day Initiative).

The vulnerability has been fixed in PDF-XChange Editor V9 (9.5.368) and V10 (10.0.1). Users should update to these or later versions to mitigate the risk (Zero Day Initiative).