EUVD-2025-19163CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
PDF-XChange Editor App Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of App objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26823.
Analysis
CVE-2025-6661 is a use-after-free vulnerability in PDF-XChange Editor that allows remote code execution when users open malicious PDF files or visit compromised websites. The vulnerability exploits improper object validation in App object handling, enabling attackers to execute arbitrary code with the privileges of the current user. With a CVSS score of 7.8 and local attack vector requiring user interaction, this represents a significant risk to PDF-XChange Editor users, particularly in environments where documents from untrusted sources are frequently processed.
Technical Context
The vulnerability exists in PDF-XChange Editor's handling of App objects, which are components responsible for managing application-level operations and interactions. The root cause is classified as CWE-416 (Use-After-Free), a memory safety vulnerability where the application fails to validate whether an object still exists before performing operations on it. When an App object is freed from memory but references to it persist, subsequent operations on that dangling pointer can be manipulated by attackers to corrupt memory or redirect execution flow. This is particularly dangerous in PDF processing applications where embedded scripts or objects can trigger application-level functions. The vulnerability was originally tracked as ZDI-CAN-26823 by Trend Micro's Zero Day Initiative before public disclosure as CVE-2025-6661.
Affected Products
PDF-XChange Editor (specific version numbers not provided in description). The vulnerability affects the App object handler component across installations. CPE string would typically be: cpe:2.7:a:tracker-software:pdf-xchange_editor:*:*:*:*:*:*:*:* (versions to be confirmed by vendor advisory). Users should consult Tracker Software's official security advisories for precise version scope. The vulnerability can be triggered through: (1) Opening malicious PDF files directly, (2) Visiting malicious web pages that attempt to load PDFs in PDF-XChange Editor, (3) PDF files embedded in email attachments or collaboration platforms.
Remediation
Immediate actions: (1) Check Tracker Software's official website and security advisories for patched versions of PDF-XChange Editor; (2) Update to the latest patched version when available; (3) Implement file type restrictions and disable automatic PDF opening in email clients; (4) Use application whitelisting to restrict PDF-XChange Editor execution to trusted sources only. Interim mitigations pending patches: (1) Disable JavaScript/scripting support in PDF-XChange Editor settings where possible; (2) Configure the application to run with minimal privileges; (3) Use sandboxed PDF readers (such as web-based viewers) for untrusted documents; (4) Educate users to avoid opening PDFs from untrusted sources; (5) Monitor for suspicious PDF-XChange Editor process behavior using endpoint detection and response (EDR) tools. Vendor advisory and patch availability should be confirmed directly with Tracker Software.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today