CVE-2025-6644: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2025-6644 is a use-after-free (UAF) vulnerability in PDF-XChange Editor's U3D file parsing component that allows remote attackers to execute arbitrary code. The flaw affects PDF-XChange Editor and PDF-Tools version 10.5.2.395. It was reported to the vendor on March 7, 2025, and publicly disclosed on June 25, 2025, via a coordinated release. The vulnerability carries a CVSS v3.0 base score of 7.8 (High) (ZDI Advisory, PDF-XChange Bulletins).

The vulnerability is classified as CWE-416 (Use After Free) and stems from the U3D file parser failing to validate the existence of an object before performing operations on it, resulting in a use-after-free condition (ZDI Advisory). An attacker exploits this by crafting a malicious U3D file (typically embedded within a PDF) that, when parsed by the editor, triggers the UAF and allows arbitrary code execution in the context of the current process. The attack vector is local (the file must be opened by the target), and user interaction is required — the victim must open a malicious file or visit a malicious page. The vulnerability was tracked internally as ZDI-CAN-26536 and credited to an anonymous researcher (ZDI Advisory).

Successful exploitation grants an attacker arbitrary code execution in the security context of the current user process, resulting in high confidentiality, integrity, and availability impact. This could lead to complete system compromise, unauthorized access to sensitive data, installation of malware, or manipulation of system resources (ZDI Advisory). Because the code executes within the user's process context, the impact is scoped to the current user's privileges, though it could serve as a foothold for further lateral movement or privilege escalation.

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.068%, indicating a low current probability of exploitation in the wild. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction, which somewhat limits opportunistic exploitation but does not preclude targeted phishing or watering-hole attacks using malicious PDF files.

1. Craft malicious file: Create a specially crafted PDF containing an embedded U3D file designed to trigger the use-after-free condition during parsing by PDF-XChange Editor version 10.5.2.395.
2. Deliver the payload: Distribute the malicious PDF via phishing email, malicious download link, or a compromised/attacker-controlled web page targeting users of PDF-XChange Editor.
3. Trigger user interaction: Induce the victim to open the malicious PDF file or visit the malicious page where the file is automatically loaded.
4. Trigger UAF condition: When PDF-XChange Editor parses the embedded U3D file, the parser accesses a previously freed object without validation, causing a use-after-free memory corruption condition.
5. Achieve code execution: The attacker leverages the memory corruption to redirect execution flow and run arbitrary code in the context of the PDF-XChange Editor process, potentially deploying a backdoor, stealing credentials, or establishing persistence (ZDI Advisory).

• File System: Presence of unexpected or suspicious PDF files containing embedded U3D data received from unknown sources; new or modified executables/scripts in user-writable directories following PDF-XChange Editor usage.
• Process: Unusual child processes spawned by the PDF-XChange Editor process (e.g., cmd.exe, powershell.exe, curl, or network-connecting processes); unexpected network connections originating from the PDF-XChange Editor process.
• Network: Outbound connections to unknown or suspicious IP addresses/domains initiated by the PDF-XChange Editor process shortly after opening a PDF file.
• Logs: Windows Event Logs showing application crashes or access violations in PDF-XChange Editor (PDFXEdit.exe) prior to suspicious activity; crash dump files (.dmp) generated in the application directory.

PDF-XChange has released a patch addressing this vulnerability; users should update PDF-XChange Editor and PDF-Tools beyond version 10.5.2.395 to the latest available version via the vendor's security bulletins page (PDF-XChange Bulletins). As interim mitigations, organizations should restrict opening PDF files from untrusted sources, implement email filtering to block suspicious PDF attachments, and educate users about the risks of opening files from unknown origins. Application whitelisting and sandboxing PDF viewers can further reduce exposure.

The vulnerability was disclosed through the Zero Day Initiative (ZDI) coordinated disclosure process and credited to an anonymous researcher, with no notable public controversy or significant social media discussion observed at the time of disclosure (ZDI Advisory). Tenable added detection support via Nessus plugin 240861 shortly after disclosure (Tenable).