CVE-2022-37355 - This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor

Back Back to CVE browser

HIGH

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor

Published Mar 29, 2023

7.8

HIGH

CVSS 3.1

EPSS 0.79%

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. Crafted data in a JPG file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17629.

Affected products

Vendor PDF-XChange Product PDF-XChange Editor Default
n/a
- Version
  9.3.361.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

PDF-XChange

PDF-XChange Editor

n/a

Version	Status	Constraints
9.3.361.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39989
Advisory
https://www.tracker-software.com/product/pdf-xchange-editor/history
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1083/
Release NotesThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39989		Advisory
https://www.tracker-software.com/product/pdf-xchange-editor/history		Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1083/		Release NotesThird Party AdvisoryVDB Entry