CVE-2023-40469: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2023-40469 is a vulnerability in PDF-XChange Editor that allows remote attackers to disclose sensitive information. The vulnerability was discovered and reported on March 15, 2023, and was publicly disclosed on August 17, 2023. The affected software is PDF-XChange Editor, and it has been assigned a CVSS score of 3.3 (ZDI Advisory).

The vulnerability exists within the parsing of XPS files and results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has been assigned a CVSS v3 score of 3.3 with the following vector: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (ZDI Advisory).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability specifically involves the parsing of XPS files (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor V9 (9.5.368) and V10 (10.0.1). Users are advised to update to these versions or later to mitigate the vulnerability (ZDI Advisory).