CVE-2024-8837: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains a vulnerability (CVE-2024-8837) that was discovered in its XPS file parsing functionality. The vulnerability was reported on June 12, 2024, and publicly disclosed on September 17, 2024. This security flaw affects PDF-XChange Editor versions prior to 10.3.1.387 (ZDI Advisory).

The vulnerability is classified as an Out-Of-Bounds Read issue that occurs during the parsing of XPS files. The specific flaw stems from insufficient validation of user-supplied data, which can result in a read operation past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access requirements with user interaction (NVD).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score reflects the potential for complete compromise of system confidentiality, integrity, and availability within the scope of the affected application (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor version 10.3.1.387. Users are advised to update to this version or later to mitigate the risk (ZDI Advisory).