CVE-2025-6646: 
PDF-XChange Editor vulnerability analysis and mitigation

PDF-XChange Editor contains a use-after-free vulnerability (CVE-2025-6646) in its U3D file parsing functionality, discovered by Mat Powell of Trend Micro Zero Day Initiative and publicly disclosed on June 25, 2025. The vulnerability affects PDF-XChange Editor version 10.5.2.395 and requires user interaction for exploitation (ZDI Advisory, Vendor Advisory).

The vulnerability stems from improper validation of object existence before performing operations during U3D file parsing. The issue has been assigned a CVSS v3.0 base score of 3.3 (LOW) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating local access is required and user interaction is necessary for exploitation (ZDI Advisory).

When successfully exploited, this vulnerability allows attackers to disclose sensitive information from affected PDF-XChange Editor installations. Additionally, the vulnerability could potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

PDF-XChange has released version 10.6.0.396 to address this vulnerability along with other security issues. Users are advised to update to the latest version to mitigate the risk (Vendor Advisory).