What is the CVSS score of CVE-2025-6647?

CVE-2025-6647 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Pdf Tools are affected by CVE-2025-6647?

CVE-2025-6647 is a high-severity remote code execution vulnerability in PDF-XChange Editor that allows attackers to execute arbitrary code when users open malicious PDF files containing U3D objects.

How to fix or mitigate CVE-2025-6647?

Within 24 hours: Inventory all systems running PDF-XChange Editor and communicate vulnerability details to affected users with guidance to avoid opening untrusted PDFs. Within 7 days: Implement application whitelisting or disable U3D file parsing in PDF-XChange Editor settings across the organization; restrict file downloads from untrusted sources. Within 30 days: Monitor vendor (Tracker Software) for patch availability and establish expedited patching process; evaluate alternative PDF readers with stronger security postures as long-term solution.

Pdf Tools CVE-2025-6647

EUVD-2025-19149 HIGH

Out-of-bounds Write (CWE-787)

2025-06-25 zdi-disclosures@trendmicro.com

RCE Buffer Overflow Adobe Pdf Tools Pdf Xchange Editor

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19149

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 22:15 nvd

HIGH 7.8

DescriptionCVE.org

PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26644.

AnalysisAI

CVE-2025-6647 is a critical out-of-bounds write vulnerability in PDF-XChange Editor's U3D file parsing engine that enables remote code execution with high integrity and confidentiality impact (CVSS 7.8). The vulnerability affects users who open malicious PDF files or embedded U3D objects, requiring only user interaction to exploit. This is a memory corruption flaw in a widely-used PDF editor with moderate attack complexity, making it a practical threat to enterprise environments handling untrusted documents.

Technical ContextAI

The vulnerability exists in PDF-XChange Editor's U3D (Universal 3D) file format parser, a component used to embed and render 3D objects within PDF documents. U3D is an open standard for 3D data that requires complex binary parsing. The root cause is CWE-787 (Out-of-bounds Write), stemming from insufficient validation of user-supplied data during U3D stream parsing—specifically, the parser fails to enforce proper bounds checking before writing data to allocated buffers. This allows an attacker to write beyond allocated heap or stack memory, corrupting adjacent objects and enabling arbitrary code execution within the PDF-XChange Editor process context. The vulnerability was tracked internally by Zero Day Initiative as ZDI-CAN-26644, indicating discovery through responsible disclosure.

RemediationAI

PATCH: Contact Tracker Software or visit their security advisory page for the latest patched version of PDF-XChange Editor addressing CVE-2025-6647. Apply all vendor-issued updates immediately. 2) TEMPORARY MITIGATION: Disable U3D rendering in PDF-XChange Editor settings if the feature is non-critical; block opening untrusted PDF files from external sources until patched. 3) PROCESS MITIGATION: Implement document scanning and sandboxing: scan incoming PDFs with updated malware engines, isolate document processing to restricted accounts or sandboxed environments, or use alternative PDF readers without U3D support for untrusted files. 4) NETWORK CONTROL: Block email attachments with PDF extensions or enforce document preview-only policies in email gateways. Specific patch versions and links to Tracker Software's advisory should be obtained directly from the vendor or monitored through CVE tracking feeds.