What is the CVSS score of CVE-2025-6660?

CVE-2025-6660 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Pdf Tools are affected by CVE-2025-6660?

PDF-XChange Editor contains a critical remote code execution vulnerability exploitable through malicious GIF files, requiring user interaction to trigger.

How to fix or mitigate CVE-2025-6660?

Within 24 hours: Inventory all systems running PDF-XChange Editor and assess user populations; issue security advisory to end-users warning against opening GIF files from untrusted sources. Within 7 days: Implement network-based controls to block GIF file execution in PDF-XChange Editor; consider disabling GIF rendering if operationally feasible; deploy email filtering rules to block GIF attachments in PDF documents. Within 30 days: Evaluate alternative PDF editors without this vulnerability; establish timeline for migration or enforce mandatory patching once vendor releases fix; conduct awareness training on social engineering risks.

Pdf Tools CVE-2025-6660

EUVD-2025-19162 HIGH

Heap-based Buffer Overflow (CWE-122)

2025-06-25 zdi-disclosures@trendmicro.com

Heap Overflow RCE Buffer Overflow Adobe Pdf Tools Pdf Xchange Pro Pdf Xchange Editor

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19162

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 22:15 nvd

HIGH 7.8

DescriptionCVE.org

PDF-XChange Editor GIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of GIF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26763.

AnalysisAI

CVE-2025-6660 is a heap-based buffer overflow vulnerability in PDF-XChange Editor's GIF file parsing engine that enables remote code execution with high severity (CVSS 7.8). The vulnerability affects users who open malicious GIF files or visit compromised web pages hosting malicious GIFs, requiring user interaction for exploitation. The flaw stems from inadequate validation of user-supplied data lengths before copying to fixed-length buffers, allowing attackers to overwrite heap memory and execute arbitrary code in the application's context.

Technical ContextAI

The vulnerability exists in PDF-XChange Editor's GIF image parsing functionality, a component responsible for decoding Graphics Interchange Format (GIF) files embedded in or associated with PDF documents. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), which occurs when the parser fails to validate the length of GIF-related data structures (such as image descriptors, color tables, or data blocks) before copying them into fixed-size heap-allocated buffers. This type of memory safety issue is common in legacy image parsing libraries where developers assume input data conforms to format specifications without defensive validation. The GIF format's variable-length fields (global color table, local color tables, data blocks with length prefixes) create opportunities for attackers to supply oversized payloads that overflow adjacent heap objects, corrupting metadata, function pointers, or other sensitive heap structures.

RemediationAI

Patch Application: Monitor Tracker Software's official security advisories for a patched version of PDF-XChange Editor that includes proper input validation in the GIF parsing code. Apply updates immediately upon availability. 2. Vendor Advisory: Check https://www.tracker-software.com/buy/pdfxchangeeditor for security updates and advisories. 3. Workarounds: Until patched, users should: (a) disable GIF rendering in PDF documents if the application settings permit, (b) avoid opening PDF files or standalone GIFs from untrusted sources, (c) use alternative PDF viewers (Adobe Reader, Foxit Reader) as temporary alternatives for untrusted documents, (d) implement application sandboxing (Windows AppContainer, virtualization) to limit RCE impact. 4. Detection: Monitor for unexpected crashes or suspicious process execution originating from pdf-xchange-related processes; check process trees for child processes spawned by PDF-XChange Editor. 5. Network Mitigation: Organizations should block access to known malicious file repositories and implement email gateway scanning to filter suspicious GIF attachments.