CVE-2023-42081: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2023-42081) was discovered in PDF-XChange Editor. The vulnerability was disclosed on September 8th, 2023, and affects the EMF file parsing functionality in the software (ZDI Advisory).

The vulnerability exists within the parsing of EMF files and stems from improper validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.0 score of 3.3 (LOW) with the vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (ZDI Advisory).

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. The impact is limited to information disclosure, but an attacker can potentially leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

User interaction is required to exploit this vulnerability as the target must visit a malicious page or open a malicious file. The vulnerability requires local access with no privileges, but does need user interaction to be exploited (ZDI Advisory).

PDF-XChange has released version 10.1.0.380 which addresses this vulnerability along with several other security issues. Users are advised to update to the latest version to mitigate this vulnerability (Security Bulletin).