CVE-2024-27331: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2024-27331 is a vulnerability discovered in PDF-XChange Editor that allows remote attackers to disclose sensitive information. The vulnerability was reported on October 3, 2023, and publicly disclosed on February 23, 2024. The issue affects PDF-XChange Editor installations and requires user interaction, specifically visiting a malicious page or opening a malicious file (ZDI Advisory).

The vulnerability exists within the parsing of EMF files in PDF-XChange Editor. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in an out-of-bounds read past the end of an allocated object. The vulnerability has been assigned a CVSS v3.0 base score of 3.3 (LOW) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating local access, low complexity, no privileges required, and user interaction required (ZDI Advisory).

The vulnerability allows attackers to disclose sensitive information from affected PDF-XChange Editor installations. When combined with other vulnerabilities, an attacker could potentially leverage this flaw to execute arbitrary code in the context of the current process (ZDI Advisory).

Exploitation of this vulnerability requires user interaction, specifically the target must visit a malicious page or open a malicious file. The vulnerability was tracked as ZDI-CAN-22287 before public disclosure (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor version 10.1.2.382. Users are advised to update to this version or later to mitigate the risk (ZDI Advisory).