CVE-2025-58113: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2025-58113 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) processing functionality of PDF-XChange Editor version 10.7.3.401, specifically triggered by a malformed EMR_SMALLTEXTOUT record. Discovered by KPC of Cisco Talos and disclosed publicly on December 2, 2025, the flaw allows an attacker to read arbitrary memory within the process by delivering a specially crafted EMF file to a victim. The vendor was notified on October 23, 2025, and released a patch on October 28, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Talos Advisory).

The root cause (CWE-125: Out-of-bounds Read) lies in how PDFXEditCore.x64.dll processes EMR_SMALLTEXTOUT records during EMF-to-PDF conversion. The EMR_SMALLTEXTOUT record includes an optional Bounds field (16 bytes at offset 0x24) that is only present when fuOptions & 0x100 equals zero. A vulnerability occurs when the recordSize field is set to a value smaller than 0x34 while fuOptions & 0x100 is simultaneously zero — the application unconditionally attempts to read the Bounds field via USER32!CopyRect, even though the record buffer does not contain sufficient data, resulting in an access violation (c0000005). The flaw is observable with Page Heap enabled, where the CopyRect call reads beyond the allocated record buffer into uninitialized or out-of-bounds memory (Talos Advisory).

Successful exploitation allows an attacker to read arbitrary memory contents within the PDF-XChange Editor process, posing a high confidentiality risk. Sensitive data resident in process memory — such as document contents, credentials cached by the application, or other in-memory artifacts — could be disclosed. There is no impact to system integrity or availability, and the vulnerability does not directly enable code execution or lateral movement (Talos Advisory, Feedly).

1. Craft a malicious EMF file: Create an EMF file containing a valid EMR_HEADER record followed by a crafted EMR_SMALLTEXTOUT record (recordType = 0x0000006C) where fuOptions & 0x100 equals zero (indicating the Bounds field should be present) but recordSize is set to a value less than 0x34 (e.g., 0x28), making the record too short to contain the full Bounds field.
2. Deliver the file to the target: Send the crafted EMF file to the victim via email attachment, a malicious download link, or embedding it in a document — any vector that causes the victim to open it with PDF-XChange Editor (e.g., triggering EMF-to-PDF conversion).
3. Trigger EMF processing: When the victim opens the file, PDFXEditCore.x64.dll parses the EMF records. Upon encountering the malformed EMR_SMALLTEXTOUT record, the application checks fuOptions & 0x100, finds it zero, and proceeds to call USER32!CopyRect to read the Bounds field at offset r14+0x24.
4. Out-of-bounds read occurs: Because the record buffer ends before offset 0x34, CopyRect reads 16 bytes beyond the valid record data, accessing uninitialized or adjacent memory. This results in an access violation and potential disclosure of process memory contents to the attacker (e.g., via a controlled crash dump or side-channel) (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders (%TEMP%, %APPDATA%), or email attachment staging areas.
• Process: PDF-XChange Editor (PDFXEdit.exe) crashing with access violation code c0000005 in USER32!CopyRect or PDFXEditCore_x64!PXV_GetInstance+0x1db0048; Windows Error Reporting (WER) crash dumps referencing PDFXEditCore.x64.dll.
• Logs: Windows Application Event Log entries showing faulting module PDFXEditCore.x64.dll with exception code 0xc0000005; crash dumps in %LOCALAPPDATA%\CrashDumps or %TEMP% associated with PDFXEdit.exe.
• Network: Inbound delivery of .emf files or archives containing .emf files from external or untrusted sources via email or web traffic (Talos Advisory).

PDF-XChange Co. Ltd released a patch on October 28, 2025 (prior to public disclosure); users should update PDF-XChange Editor to a version newer than 10.7.3.401. As interim mitigations, users should avoid opening EMF files or EMF-containing documents from untrusted sources, and administrators should consider restricting EMF file handling via application whitelisting or file type filtering at the email gateway. Network segmentation and user awareness training regarding unsolicited file attachments are also recommended (Talos Advisory, Feedly).

Cisco Talos published a detailed vulnerability report (TALOS-2025-2280) on December 2, 2025, alongside a blog post covering PDF-XChange Editor vulnerabilities together with Socomec DIRIS Digiware M-Series issues, indicating coordinated disclosure activity (Talos Blog). The vulnerability was also tracked by Tenable and aggregated by multiple vulnerability intelligence platforms. No significant social media controversy or broad community debate has been observed around this CVE.