What is the CVSS score of EUVD-2025-19156?

EUVD-2025-19156 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Pdf Tools are affected by EUVD-2025-19156?

CVE-2025-6654 is a high-severity remote code execution vulnerability affecting PDF-XChange Editor that requires user interaction to exploit.

How to fix or mitigate EUVD-2025-19156?

Within 24 hours: Identify all systems running PDF-XChange Editor and assess usage criticality; communicate findings to affected departments. Within 7 days: Implement network and email controls to block suspicious PRC file transfers; disable PRC file handling in PDF-XChange Editor if business operations permit. Within 30 days: Evaluate alternative PDF solutions without this vulnerability; establish a vendor patch monitoring process and develop a transition timeline if the application cannot be adequately secured.

Pdf Tools EUVD-2025-19156

| CVE-2025-6654 HIGH

Out-of-bounds Write (CWE-787)

2025-06-25 zdi-disclosures@trendmicro.com

RCE Buffer Overflow Adobe Pdf Tools Pdf Xchange Editor

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19156

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 22:15 nvd

HIGH 7.8

DescriptionCVE.org

PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26729.

AnalysisAI

CVE-2025-6654 is an out-of-bounds write vulnerability in PDF-XChange Editor's PRC file parser that enables remote code execution with high severity (CVSS 7.8). The vulnerability affects PDF-XChange Editor installations when users open malicious PRC files or visit compromised web pages, allowing attackers to execute arbitrary code in the application's context. The vulnerability (formerly tracked as ZDI-CAN-26729) requires user interaction but poses significant risk due to the ubiquity of PDF applications and the high impact of code execution.

Technical ContextAI

The vulnerability exists in PDF-XChange Editor's PRC (likely Portable Rich Content or a proprietary format) file parsing subsystem. The root cause is CWE-787 (Out-of-bounds Write), stemming from insufficient validation of user-supplied data within PRC file structures. When the parser processes maliciously crafted PRC files, it fails to enforce proper boundary checks on buffer write operations, allowing an attacker to write data beyond allocated buffer boundaries. This classic memory corruption vulnerability can be leveraged to overwrite adjacent heap or stack memory, potentially corrupting critical data structures or injecting executable code. The attack surface includes both direct file opening and web-based delivery mechanisms (embedded PRC files in HTML or malicious download scenarios).

RemediationAI

Vendor Patch: Obtain and apply the latest security patch from Tracker Software. Check the official website (tracker-software.com) or their security advisories for the patched version number and download links. 2. Immediate Workarounds: (a) Disable PRC file type associations or disable auto-opening of PRC files in PDF-XChange Editor until patching is available; (b) Implement file-type filtering at the perimeter to block PRC files from reaching end-users; (c) Educate users not to open PRC files from untrusted sources. 3. Defense-in-Depth: Deploy endpoint protection with exploit mitigation features (DEP/ASLR, control flow guard) to raise the bar for exploitation. 4. Configuration: If feasible, disable PDF-XChange Editor's web integration features or run it in a sandboxed environment for untrusted document handling. 5. Monitoring: Monitor process execution logs for suspicious PDF-XChange Editor child processes (cmd.exe, powershell.exe) as an indicator of successful exploitation.