CVE-2025-64085: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2025-64085 is a NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor version 10.7.3.401 that allows attackers to cause a Denial of Service (DoS) via crafted input. It was published on December 9, 2025, and classified under CWE-476 (NULL Pointer Dereference). The vulnerability carries a CVSS v3.1 base score of 7.5 (High), with network-based attack vector and no authentication required (Red Hat CVE, Jeroscope Advisory).

The root cause is a NULL pointer dereference (CWE-476) within the importDataObject() function of PDF-XChange Editor v10.7.3.401. An attacker can trigger this flaw by supplying a specially crafted PDF or data object input that causes the function to dereference a NULL pointer, resulting in an application crash. No authentication or user interaction is required, and attack complexity is low, making this straightforward to exploit remotely. A proof-of-concept advisory detailing the vulnerability mechanics is publicly available (Jeroscope Advisory).

Successful exploitation crashes the PDF-XChange Editor application, resulting in a complete loss of availability for the affected process. The impact is limited to availability — there is no confidentiality or integrity impact, meaning attackers cannot access or modify data through this vulnerability alone. In environments where PDF-XChange Editor is used for critical document workflows, repeated exploitation could significantly disrupt user productivity and business operations (Red Hat CVE, Jeroscope Advisory).

A proof-of-concept exploit is publicly available via the Jeroscope security advisory published December 10, 2025. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, indicating a low probability of exploitation in the near term (Jeroscope Advisory, Red Hat CVE).

1. Craft a malicious PDF: Create a specially crafted PDF file or data object designed to trigger a NULL pointer dereference when processed by the importDataObject() function in PDF-XChange Editor v10.7.3.401.
2. Deliver the payload: Distribute the malicious file to a target user via email attachment, web download, or shared network location — no authentication to the application is required.
3. Trigger processing: Induce the target to open the crafted file in PDF-XChange Editor, causing the application to invoke the vulnerable importDataObject() function.
4. Achieve DoS: The NULL pointer dereference causes the application to crash, resulting in a denial of service for the affected user or process (Jeroscope Advisory).

• File System: Presence of unexpected or suspicious PDF files received from external sources, particularly those with unusual structure or metadata.
• Logs: Application crash logs or Windows Event Viewer entries showing PDF-XChange Editor (PDFXEdit.exe) terminating unexpectedly with an access violation or null pointer exception.
• Process: Repeated or automated crashes of the PDFXEdit.exe process, especially when opening specific PDF files; crash dump files (.dmp) generated in the application or system temp directory.

The patch status for CVE-2025-64085 is not explicitly confirmed in available sources; users should check the PDF-XChange website for the latest updates and apply any available patches immediately. As interim mitigations: avoid opening PDF files from untrusted or unknown sources in PDF-XChange Editor; implement application whitelisting to restrict which files can be processed; and consider restricting access to the application in high-risk environments. Monitoring the vendor's security update channel for a patched release is strongly recommended (Red Hat CVE, Jeroscope Advisory).