CVE-2024-8849: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains an information disclosure vulnerability (CVE-2024-8849) that was discovered and disclosed in November 2024. The vulnerability affects PDF-XChange Editor installations and specifically exists within the handling of AcroForms. This security flaw requires user interaction, where the target must visit a malicious page or open a malicious file (ZDI Advisory).

The vulnerability stems from the lack of proper validation of user-supplied data when handling AcroForms, which can result in an out-of-bounds read past the end of an allocated object. The issue has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) by NIST with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, while Zero Day Initiative assessed it with a score of 3.3 (LOW) (NVD).

When successfully exploited, this vulnerability allows attackers to disclose sensitive information on affected installations of PDF-XChange Editor. The vulnerability could potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor version 10.4.0.388. Users are advised to update to this version or later to mitigate the risk (ZDI Advisory).