CVE-2023-42113: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2023-42113 is a security vulnerability discovered in PDF-XChange Editor affecting its EMF file parsing functionality. The vulnerability was disclosed on September 29, 2023, and allows remote attackers to disclose sensitive information on affected installations of the software. The vulnerability requires user interaction, specifically requiring the target to visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability exists within the parsing of EMF files in PDF-XChange Editor. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. This out-of-bounds read vulnerability has been assigned a CVSS score of 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) (ZDI Advisory).

The vulnerability allows attackers to disclose sensitive information from affected installations. While the immediate impact is limited to information disclosure, attackers could potentially leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

The vulnerability requires user interaction to be exploited. An attacker would need to convince a user to visit a malicious page or open a malicious file. The local attack vector and requirement for user interaction somewhat limit the exploitability of this vulnerability (ZDI Advisory).

PDF-XChange has released an update to correct this vulnerability. Users are advised to update to the latest version of the software to protect against this security issue (ZDI Advisory, Tracker Software).