CVE-2023-42071: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2023-42071 is a remote code execution vulnerability in PDF-XChange Editor discovered in 2023. The vulnerability affects the PDF file parsing functionality and was disclosed on September 8, 2023. The issue has been assigned a CVSS score of 7.8 (High) (ZDI Advisory).

The vulnerability exists within the parsing of PDF files and stems from improper validation of user-supplied data, which can result in an out-of-bounds write past the end of an allocated object. This flaw requires user interaction to exploit, specifically requiring the target to visit a malicious page or open a malicious file (ZDI Advisory, Tracker Software).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process on affected installations of PDF-XChange Editor (ZDI Advisory).

The vulnerability requires user interaction for exploitation, specifically requiring the target to visit a malicious page or open a malicious file. The attack vector is local (AV:L) with low attack complexity (AC:L) and no privileges required (PR:N) (ZDI Advisory).

PDF-XChange has released version 10.1.0.380 which addresses this vulnerability along with several other security issues. Users are advised to update to the latest version (Tracker Software).