CVE-2024-27330: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains an out-of-bounds read vulnerability in its EMF file parsing functionality. The vulnerability (CVE-2024-27330) was discovered and reported on October 3, 2023, and publicly disclosed on February 23, 2024. This security flaw affects PDF-XChange Editor installations and requires user interaction to be exploited (ZDI Advisory).

The vulnerability stems from improper validation of user-supplied data during the parsing of EMF files, which can result in a read past the end of an allocated object. The issue has been assigned a CVSS v3.0 base score of 3.3 (LOW) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating local access, low complexity, no privileges required, and user interaction required (ZDI Advisory).

When successfully exploited, this vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. The impact is limited to information disclosure, though it could potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

Exploitation of this vulnerability requires user interaction, specifically that the target must visit a malicious page or open a malicious file. The attack vector is local, with low attack complexity and no privileges required for exploitation (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor version 10.1.2.382. Users are advised to update to this version or later to mitigate the risk (ZDI Advisory).