CVE-2025-47152: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2025-47152 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) processing functionality of PDF-XChange Editor version 10.6.0.396, specifically within the handling of the EMR_EXTCREATEFONTINDIRECTW record's Facename field. Discovered by KPC of Cisco Talos, it was disclosed to the vendor on June 18, 2025, patched on July 22, 2025, and publicly released on August 5, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Talos Advisory).

The root cause (CWE-125: Out-of-bounds Read) lies in PDF-XChange Editor's EMF parser, which fails to validate the length of the Facename field in EMR_EXTCREATEFONTINDIRECTW records. The application relies solely on the presence of a NULL-terminating character to determine the string's length; if the Facename field (offset 0x28, maximum 32 Unicode characters) omits the NULL terminator, an internal loop in PDFXEditCore_x64 continues reading beyond the allocated buffer until it either finds a NULL byte or triggers an access violation (c0000005). Exploitation requires a user to open or convert a specially crafted EMF file, making user interaction a prerequisite. The full technical write-up with debugger traces is available from Cisco Talos (Talos Advisory).

Successful exploitation allows an attacker to read arbitrary memory within the PDF-XChange Editor process, potentially exposing sensitive in-memory data such as credentials, document contents, or other process-resident information. There is no impact on integrity or availability — the vulnerability is limited to confidentiality (CVSS C:H, I:N, A:N). The attack requires user interaction (opening a malicious EMF file) but no authentication or special privileges, making it feasible via phishing or malicious document delivery (Talos Advisory).

1. Craft malicious EMF file: Create a specially crafted EMF file containing an EMR_EXTCREATEFONTINDIRECTW record (recordType 0x00000052) where the Facename field (offset 0x28, 64 bytes) is filled with non-NULL Unicode characters and lacks a NULL terminator, causing the parser to read beyond the buffer boundary.
2. Deliver the file: Distribute the malicious EMF file to the target via phishing email, malicious download link, or embedded in a document, relying on the victim to open it with PDF-XChange Editor (e.g., by triggering EMF-to-PDF conversion).
3. Trigger parsing: When the victim opens or converts the EMF file, PDF-XChange Editor's EMF parser processes the EMR_EXTCREATEFONTINDIRECTW record and calls the Facename length-calculation routine in PDFXEditCore_x64.
4. Out-of-bounds read occurs: The internal loop (inc rdi / cmp word ptr [rdx+rdi*2], r13w) iterates past the end of the allocated buffer, reading adjacent memory contents until a NULL word is found or an access violation occurs.
5. Information disclosure: Memory contents read beyond the buffer boundary may be incorporated into application state or error output, potentially disclosing sensitive in-process data to the attacker (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders (%TEMP%), or email attachment staging areas.
• Process: PDF-XChange Editor (PDFXEdit.exe) crashing with access violation code c0000005 in PDFXEditCore_x64.dll at or near PXV_GetInstance+0x9893; application crash dumps referencing gdi32full!bInternalPlayEMF and GDI32!EnumEnhMetaFileStub in the call stack.
• Logs: Windows Event Log entries (Application log) showing faulting module PDFXEditCore_x64.dll with exception code 0xc0000005; Windows Error Reporting (WER) crash reports for PDFXEdit.exe.
• Network: Unexpected inbound delivery of .emf files via email or web downloads from untrusted or newly registered domains, particularly if followed by PDF-XChange Editor process anomalies (Talos Advisory).

PDF-XChange Co. Ltd released a patch on July 22, 2025; users should update PDF-XChange Editor to a version newer than 10.6.0.396. As interim workarounds, users should avoid opening EMF files from untrusted sources, disable automatic EMF-to-PDF conversion where possible, and implement file-type filtering at email and web gateways to block unsolicited .emf attachments. Application whitelisting and user awareness training on the risks of opening files from unknown sources are also recommended (Talos Advisory).

Cisco Talos researcher KPC discovered and reported the vulnerability, with Talos publishing the full technical advisory (TALOS-2025-2203) on August 5, 2025, following coordinated disclosure with the vendor. The vulnerability was also covered in a Talos blog post grouping it with other PDF viewer and library vulnerabilities discovered in the same research cycle (Talos Blog). No significant broader community or social media reactions have been identified beyond standard vulnerability aggregator coverage.