CVE-2025-0907: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2025-0907 is a vulnerability discovered in PDF-XChange Editor affecting versions up to (excluding) 10.4.2.390. The vulnerability was discovered and reported on September 26, 2024, and publicly disclosed on January 31, 2025. This security flaw exists within the parsing of JB2 files in PDF-XChange Editor (ZDI Advisory).

The vulnerability is classified as an Out-of-Bounds Read Information Disclosure vulnerability (CWE-125). The issue stems from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. The vulnerability has received varying CVSS v3.x scores: NIST rates it as HIGH with a base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while Zero Day Initiative rates it as LOW with a score of 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) (NVD).

The vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. An attacker can potentially leverage this vulnerability in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor version 10.4.2.390. Users are advised to upgrade to this version or later to mitigate the vulnerability (ZDI Advisory).