CVE-2023-42051: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVE-2023-42051) was discovered in PDF-XChange Editor. The vulnerability was disclosed on September 8th, 2023, and affects the U3D file parsing functionality in the software (ZDI Advisory).

The vulnerability exists within the parsing of U3D files. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. The vulnerability has been assigned a CVSS v3.0 score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. An attacker can leverage this vulnerability to execute code in the context of the current process (ZDI Advisory).

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability was reported to the vendor on April 28, 2023, and was publicly disclosed on September 8, 2023 (ZDI Advisory).

PDF-XChange has issued an update to correct this vulnerability. Users should update to the latest version of the software to protect against this vulnerability (Security Bulletin).