CVE-2023-42075: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2023-42075 is a Use-After-Free Remote Code Execution vulnerability affecting PDF-XChange Editor. The vulnerability was discovered in July 2023 and publicly disclosed on September 8, 2023. The issue specifically affects the JPG file parsing functionality in PDF-XChange Editor (ZDI Advisory, Tracker Software).

The vulnerability exists within the parsing of JPG files in PDF-XChange Editor. The specific flaw results from the lack of validating the existence of an object prior to performing operations on the object. This Use-After-Free condition occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain TIFF files. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (HIGH) with the vector string: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process on affected installations of PDF-XChange Editor. The successful exploitation could lead to complete compromise of the affected system with the same privileges as the vulnerable application (ZDI Advisory).

The vulnerability requires user interaction to exploit, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges but does need user interaction (ZDI Advisory).

PDF-XChange has released version 10.1.0.380 which addresses this vulnerability along with several other security issues. Users are advised to update to the latest version of the software to mitigate this vulnerability (Tracker Software).