What is the CVSS score of EUVD-2025-19163?

EUVD-2025-19163 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Pdf Tools are affected by EUVD-2025-19163?

CVE-2025-6661 is a high-severity remote code execution vulnerability in PDF-XChange Editor that allows attackers to execute arbitrary code when users open malicious files or visit compromised…

How to fix or mitigate EUVD-2025-19163?

Within 24 hours: Inventory all systems running PDF-XChange Editor and communicate risk to affected departments; restrict PDF-XChange Editor usage to essential personnel only and disable it where not required. Within 7 days: Implement application whitelisting or disable the application in high-risk environments; deploy enhanced email filtering to block suspicious PDF attachments; conduct user awareness training on opening files from untrusted sources. Within 30 days: Establish a vendor patch monitoring process; evaluate alternative PDF readers without this vulnerability; migrate critical workflows to patched or alternative solutions.

Pdf Tools EUVD-2025-19163

| CVE-2025-6661 HIGH

Use After Free (CWE-416)

2025-06-25 zdi-disclosures@trendmicro.com

RCE Pdf Tools Pdf Xchange Editor

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19163

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 22:15 nvd

HIGH 7.8

DescriptionCVE.org

PDF-XChange Editor App Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of App objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26823.

AnalysisAI

CVE-2025-6661 is a use-after-free vulnerability in PDF-XChange Editor that allows remote code execution when users open malicious PDF files or visit compromised websites. The vulnerability exploits improper object validation in App object handling, enabling attackers to execute arbitrary code with the privileges of the current user. With a CVSS score of 7.8 and local attack vector requiring user interaction, this represents a significant risk to PDF-XChange Editor users, particularly in environments where documents from untrusted sources are frequently processed.

Technical ContextAI

The vulnerability exists in PDF-XChange Editor's handling of App objects, which are components responsible for managing application-level operations and interactions. The root cause is classified as CWE-416 (Use-After-Free), a memory safety vulnerability where the application fails to validate whether an object still exists before performing operations on it. When an App object is freed from memory but references to it persist, subsequent operations on that dangling pointer can be manipulated by attackers to corrupt memory or redirect execution flow. This is particularly dangerous in PDF processing applications where embedded scripts or objects can trigger application-level functions. The vulnerability was originally tracked as ZDI-CAN-26823 by Trend Micro's Zero Day Initiative before public disclosure as CVE-2025-6661.

RemediationAI

Immediate actions: (1) Check Tracker Software's official website and security advisories for patched versions of PDF-XChange Editor; (2) Update to the latest patched version when available; (3) Implement file type restrictions and disable automatic PDF opening in email clients; (4) Use application whitelisting to restrict PDF-XChange Editor execution to trusted sources only. Interim mitigations pending patches: (1) Disable JavaScript/scripting support in PDF-XChange Editor settings where possible; (2) Configure the application to run with minimal privileges; (3) Use sandboxed PDF readers (such as web-based viewers) for untrusted documents; (4) Educate users to avoid opening PDFs from untrusted sources; (5) Monitor for suspicious PDF-XChange Editor process behavior using endpoint detection and response (EDR) tools. Vendor advisory and patch availability should be confirmed directly with Tracker Software.