CVE-2025-0910: 
PDF-XChange Editor vulnerability analysis and mitigation

The vulnerability (CVE-2025-0910) is a remote code execution flaw in PDF-XChange Editor discovered in December 2024 and publicly disclosed on January 31, 2025. The vulnerability affects PDF-XChange Editor installations up to version 10.5.0.393 (NVD, ZDI Advisory).

The vulnerability exists within the parsing of U3D files in PDF-XChange Editor. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) by NIST NVD, while Zero Day Initiative rates it at 7.8 HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of PDF-XChange Editor. The impact includes potential complete compromise of the system with the same privileges as the application (ZDI Advisory).

The vulnerability has been fixed in PDF-XChange Editor version 10.5.0.393. Users are advised to upgrade to this version or later to mitigate the risk (ZDI Advisory).