EUVD-2025-19156
CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26729.
Analysis
CVE-2025-6654 is an out-of-bounds write vulnerability in PDF-XChange Editor's PRC file parser that enables remote code execution with high severity (CVSS 7.8). The vulnerability affects PDF-XChange Editor installations when users open malicious PRC files or visit compromised web pages, allowing attackers to execute arbitrary code in the application's context. The vulnerability (formerly tracked as ZDI-CAN-26729) requires user interaction but poses significant risk due to the ubiquity of PDF applications and the high impact of code execution.
Technical Context
The vulnerability exists in PDF-XChange Editor's PRC (likely Portable Rich Content or a proprietary format) file parsing subsystem. The root cause is CWE-787 (Out-of-bounds Write), stemming from insufficient validation of user-supplied data within PRC file structures. When the parser processes maliciously crafted PRC files, it fails to enforce proper boundary checks on buffer write operations, allowing an attacker to write data beyond allocated buffer boundaries. This classic memory corruption vulnerability can be leveraged to overwrite adjacent heap or stack memory, potentially corrupting critical data structures or injecting executable code. The attack surface includes both direct file opening and web-based delivery mechanisms (embedded PRC files in HTML or malicious download scenarios).
Affected Products
PDF-XChange Editor (vendor: Tracker Software): Specific version numbers are not provided in the vulnerability description. Based on the CVE nomenclature (2025-6654) and ZDI tracking (ZDI-CAN-26729), affected versions likely include recent releases prior to the patch date. CPE data would typically follow the pattern: cpe:2.3:a:tracker_software:pdf-xchange_editor:*:*:*:*:*:*:*:* (with version constraints to be determined from vendor advisory). Related products potentially affected include PDF-XChange Viewer and other Tracker Software PDF solutions that may share the PRC parsing library. Users should consult Tracker Software's official advisory for precise version information and affected configurations (Windows platform primarily, though cross-platform support varies by version).
Remediation
1. **Vendor Patch**: Obtain and apply the latest security patch from Tracker Software. Check the official website (tracker-software.com) or their security advisories for the patched version number and download links. 2. **Immediate Workarounds**: (a) Disable PRC file type associations or disable auto-opening of PRC files in PDF-XChange Editor until patching is available; (b) Implement file-type filtering at the perimeter to block PRC files from reaching end-users; (c) Educate users not to open PRC files from untrusted sources. 3. **Defense-in-Depth**: Deploy endpoint protection with exploit mitigation features (DEP/ASLR, control flow guard) to raise the bar for exploitation. 4. **Configuration**: If feasible, disable PDF-XChange Editor's web integration features or run it in a sandboxed environment for untrusted document handling. 5. **Monitoring**: Monitor process execution logs for suspicious PDF-XChange Editor child processes (cmd.exe, powershell.exe) as an indicator of successful exploitation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today