CVE-2023-42087: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2023-42087) was discovered in PDF-XChange Editor. The vulnerability was disclosed on September 8, 2023, and affects installations of PDF-XChange Editor. This vulnerability requires user interaction, specifically the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability exists within the parsing of EMF files and results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.0 base score of 3.3 (Low) with the vector string: AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-125 (Out-of-bounds Read) (ZDI Advisory, NVD).

When successfully exploited, this vulnerability allows attackers to disclose sensitive information on affected installations. The vulnerability can potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction for exploitation. An attacker would need to convince a target to visit a malicious page or open a malicious file. The attack complexity is considered Low, requires no privileges, but does require user interaction (ZDI Advisory).

PDF-XChange has released an update to address this vulnerability. Users should update their installations to the latest version as detailed in the vendor's security bulletins (Security Bulletin).