CVE-2022-42401: pdf-xchange pdf-xchange_editor Out-of-bounds Read
Vulnerability summary
CVE-2022-42401 is a medium (CVSS 5.5) Out-of-bounds Read vulnerability in pdf-xchange pdf-xchange_editor. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.2% of scored vulnerabilities.
Timeline
- 26-01-2023PublishedVulnerability first disclosed.
- 31-03-2025Last modifiedVulnerability information updated.
Description
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18533.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST3.3LowCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.36% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Pdf-xchange1 product
- pdf-xchange_editor9.4.363.0 | < 9.5.366.0
1 vendor · 1 product
References
2 links- www.tracker-software.com/product/pdf-xchange-editor/historyVendor Advisory