The version of PDF-XChange Editor installed on the remote Windows host is prior to 10.4.2.390. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A vulnerability that allows remote attackers to execute arbitrary code on affected installations of     PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must     visit a malicious page or open a malicious file. The specific flaw exists within the parsing of RTF     files. The issue results from the lack of proper validation of the length of user-supplied data prior to     copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute     code in the context of the current process. (CVE-2025-0903)

  - A vulnerability that allows remote attackers to disclose sensitive information on affected installations     of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target     must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of     XPS files. The issue results from the lack of proper validation of user-supplied data, which can result     in a read past the end of an allocated object. An attacker can leverage this in conjunction with other     vulnerabilities to execute arbitrary code in the context of the current process. (CVE-2025-0904)     
  - A vulnerability that allows remote attackers to disclose sensitive information on affected installations     of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target     must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of     JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result     in a read past the end of an allocated object. An attacker can leverage this in conjunction with other     vulnerabilities to execute arbitrary code in the context of the current process. (CVE-2025-0905)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

PDF-XChange Editor < 10.4.2.390 Multiple Vulnerabilities

high Nessus Plugin ID 215059

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Feb 7, 2025, 4:52 PM New Plugin Feed: 202502071652
Version 1.2 Feb 7, 2025, 8:35 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") Plugin Feed: 202502070835
Version 1.1 Feb 6, 2025, 5:37 PM New Plugin Feed: 202502061737