CVE-2023-39503: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains an Out-Of-Bounds Read Information Disclosure vulnerability (CVE-2023-39503) that was discovered and reported on January 7, 2023. The vulnerability affects PDF-XChange Editor installations and requires user interaction to exploit, specifically when parsing OXPS files (ZDI Advisory).

The vulnerability exists within the parsing of OXPS files and results from the lack of proper validation of user-supplied data, which can lead to a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 3.3 (Low) with the vector: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The issue is classified as CWE-125 (Out-of-bounds Read) (ZDI Advisory).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction to exploit, as the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requires no privileges, but does need user interaction (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor V9 (9.5.368) and V10 (10.0.1). Users should update to these versions or later to mitigate the vulnerability (ZDI Advisory).