CVE-2023-39502: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2023-39502 is a remote code execution vulnerability affecting PDF-XChange Editor software. The vulnerability was discovered on January 7, 2023, and publicly disclosed on August 17, 2023. The issue exists within the parsing of OXPS files and affects installations of PDF-XChange Editor prior to versions V9 (9.5.368) and V10 (10.0.1) (ZDI Advisory).

The vulnerability stems from the lack of proper validation of user-supplied data during OXPS file parsing, which can result in a write past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (HIGH) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The flaw is classified as CWE-787 (Out-of-bounds Write) (ZDI Advisory).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of PDF-XChange Editor. The high CVSS score reflects the potential for complete compromise of confidentiality, integrity, and availability of the targeted system (ZDI Advisory).

Exploitation of this vulnerability requires user interaction, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges, but does need user interaction to trigger the vulnerable code path (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor V9 (9.5.368) and V10 (10.0.1). Users are advised to upgrade to these or later versions to mitigate the risk (ZDI Advisory).