CVE-2023-42060: 
PDF-XChange Editor vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2023-42060) was discovered in PDF-XChange Editor affecting the parsing of U3D files. The vulnerability was disclosed on September 8, 2023, and was reported by Mat Powell of Trend Micro Zero Day Initiative. The issue affects installations of PDF-XChange Editor and requires user interaction to exploit (Zero Day Initiative).

The vulnerability stems from the lack of proper validation of user-supplied data when parsing U3D files, which can result in an out-of-bounds read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, no privileges required, and user interaction required (Zero Day Initiative).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (Zero Day Initiative).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, making it relatively straightforward to exploit once user interaction is achieved (Zero Day Initiative).

PDF-XChange has released version 10.0.0.370 to address this vulnerability along with several other security issues. Users are advised to update to the latest version to mitigate the risk (Tracker Software).