CVE-2025-6655: 
PDF-XChange Editor vulnerability analysis and mitigation

CVE-2025-6655 is an out-of-bounds read information disclosure vulnerability in PDF-XChange Editor's PRC file parsing component. It affects PDF-XChange Editor and PDF-Tools version 10.5.2.395 and was reported to the vendor on March 21, 2025, with coordinated public disclosure on June 25, 2025. The vulnerability was tracked internally as ZDI-CAN-26730 and assigned CVSS v3.0 base score of 3.3 (Low) (ZDI Advisory, PDF-XChange Bulletins).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and stems from insufficient validation of user-supplied data during the parsing of PRC (Product Representation Compact) files within PDF-XChange Editor. When a specially crafted PRC file is processed, the parser reads past the end of an allocated memory object, potentially exposing adjacent memory contents. Exploitation requires user interaction — the target must open a malicious file or visit a malicious page — and the attack vector is local. While the standalone impact is limited to information disclosure, the vulnerability can be chained with other flaws to achieve arbitrary code execution in the context of the current process (ZDI Advisory).

Successful exploitation results in the disclosure of sensitive information from memory accessible to the PDF-XChange Editor process, with low confidentiality impact and no integrity or availability impact. The scope is limited to the affected application process and does not directly enable privilege escalation or lateral movement. However, the vulnerability's value increases significantly when combined with other vulnerabilities, as leaked memory contents (e.g., heap addresses or sensitive data) could facilitate bypassing exploit mitigations and achieving arbitrary code execution (ZDI Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed. The vulnerability was reported anonymously to Trend Micro's Zero Day Initiative and disclosed following a coordinated timeline. The EPSS score is approximately 0.03%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog (ZDI Advisory).

1. Craft a malicious PRC file: Create a specially crafted PRC (Product Representation Compact) file with malformed or oversized data structures that trigger the out-of-bounds read during parsing.
2. Deliver the payload: Host the malicious file on a web page or distribute it via email/phishing to induce the target to open it with PDF-XChange Editor.
3. Trigger the vulnerability: When the target opens the malicious file, PDF-XChange Editor's PRC parser reads beyond the end of an allocated memory object due to missing bounds validation.
4. Harvest disclosed memory: The out-of-bounds read exposes adjacent memory contents, which may include heap metadata, pointers, or sensitive data from the process.
5. Chain with additional exploits: Use the leaked memory information (e.g., heap layout or base addresses) to defeat ASLR or other mitigations, enabling a follow-on exploit for arbitrary code execution within the PDF-XChange Editor process (ZDI Advisory).

PDF-XChange has released a patch addressing this vulnerability; users should update PDF-XChange Editor and PDF-Tools beyond version 10.5.2.395 by consulting the vendor's security bulletins page. As a general precaution, users should avoid opening PDF or PRC files from untrusted or unknown sources. Endpoint protection solutions and application sandboxing can reduce the risk of exploitation while patching is pending (PDF-XChange Bulletins).

The vulnerability received routine coverage from automated vulnerability tracking platforms including Vulners, VulDB, Tenable, and INCIBE-CERT shortly after disclosure. Social media activity was limited to automated security feed posts (e.g., RedPacketSecurity on Mastodon). No notable researcher commentary or significant media coverage beyond standard vulnerability aggregation was observed (ZDI Advisory).