Security Bulletins

2025

Security updates available in PDF-XChange Editor/Tools 10.5.0.393

Released at: 14 Jan 2025
Summary

Released version 10.5.0.393, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.4.4.392
PDF-XChange PRO 10.4.4.392
PDF-Tools 10.4.4.392
Vulnerability details
Brief Acknowledgement

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain XPS files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain U3D files and U3D streams in PDF files.

Anonymous working with Trend Micro Zero Day Initiative

Addressed potential issues with XFA files, including untrusted URL invocation, ignoring encryption element in submit action, and importing XML data without user confirmation.

Jörn Henkel
2024

Security updates available in PDF-XChange Editor/Tools 10.4.2.392

Released at: 12 Nov 2024
Summary

Released version 10.4.4.392, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.4.3.391
PDF-XChange PRO 10.4.3.391
PDF-Tools 10.4.3.391
Vulnerability details
Brief Acknowledgement

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain U3D files and U3D streams in PDF files.
  • Anonymous working with Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 10.4.2.390

Released at: 07 Oct 2024
Summary

Released version 10.4.2.390, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.4.0.388
PDF-XChange PRO 10.4.0.388
PDF-Tools 10.4.0.388
Vulnerability details
Brief Acknowledgement

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain XPS files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain RTF files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JBIG2 files or JBIG2 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 10.4.1.389

Released at: 23 Sep 2024
Summary

Released version 10.4.1.389, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.4.0.388
PDF-XChange PRO 10.4.0.388
Vulnerability details
Brief Acknowledgement

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts.
  • Mat Powell of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 10.4.0.388

Released at: 09 Sep 2024
Summary

Released version 10.4.0.388, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.3.1.387
PDF-Tools 10.3.1.387
PDF-XChange PRO 10.3.1.387
Vulnerability details
Brief Acknowledgement

Updated third-party libraries used in the PDF-XChange products.

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JBIG2 files or JBIG2 streams in PDF files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain RTF files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain TIFF files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts.
  • Mat Powell of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 10.3.1.387

Released at: 18 Jun 2024
Summary

Released version 10.3.1.387, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.3.0.386
PDF-Tools 10.3.0.386
PDF-XChange PRO 10.3.0.386
Vulnerability details
Brief Acknowledgement

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain U3D files and U3D streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain TIFF files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain XPS/OXPS files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative
  • Mat Powell of Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain EMF files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JBIG2 files or JBIG2 streams in PDF files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PNM files.
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative

Updated third-party libraries used in the PDF-XChange products.

Security updates available in PDF-XChange Editor/Tools 10.3.0.386

Released at: 29 Apr 2024
Summary

Released version 10.3.0.386, which addresses potential security and stability issues. Third-party libraries are updated to the latest stable versions.

Affected versions
Product Version
PDF-XChange Editor 10.2.1.385
PDF-XChange PRO 10.2.1.385
PDF-Tools 10.2.1.385
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
  • Anonymous working with Trend Micro Zero Day Initiative
Updated third-party libraries used in the PDF-XChange products.
2023

Security updates available in PDF-XChange Editor/Tools 10.1.3.383

Released at: 14 Nov 2023
Summary

Released version 10.1.3.383, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.1.2.382
PDF-Tools 10.1.2.382
PDF-XChange PRO 10.1.2.382
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain TIFF files.
  • Francis Provencher {PRL} working with Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 10.1.2.382

Released at: 23 Oct 2023
Summary

Released version 10.1.2.382, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.1.1.381
PDF-Tools 10.1.1.381
PDF-XChange PRO 10.1.1.381
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain EMF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG files and JPEG streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain XPS files.
  • Mat Powell of Trend Micro Zero Day Initiative
Updated third-party libraries used in the PDF-XChange products.
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
Added server certificate verification into the PDF-XChange Updater to avoid downloading installers from the wrong servers.
  • Bobby Gould and Anthony Fuller of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 10.1.1.381

Released at: 19 Sep 2023
Summary

Released version 10.1.1.381, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.1.0.380
PDF-Tools 10.1.0.380
PDF-XChange PRO 10.1.0.380
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain EMF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPG files or JPG streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 10.1.0.380

Released at: 05 Sep 2023
Summary

Released version 10.1.0.380, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 10.0.1.371
PDF-Tools 10.0.1.371
PDF-XChange PRO 10.0.1.371
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain EMF files.
  • Anonymous working with Trend Micro Zero Day Initiative
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG files and JPEG streams in PDF files.
  • Anonymous working with Trend Micro Zero Day Initiative
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain TIFF files.
  • Anonymous working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
  • rgod working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG2000 files and JPEG2000 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 10.0.0.370

Released at: 14 Jun 2023
Summary

Released version 10.0.0.370, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 9.5.368.0
PDF-Tools 9.5.368.0
PDF-XChange PRO 9.5.368.0
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts.
  • kimiya working with Trend Micro Zero Day Initiative
  • Mat Powell of Trend Micro Zero Day Initiative
  • Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain EMF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PRC files and PRC streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain U3D files and U3D streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JBIG2 files or JBIG2 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
  • Anonymous working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG2000 files or JPEG2000 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 9.5.368.0

Released at: 05 Apr 2023
Summary

Released version 9.5.368.0, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 9.5.367.0
PDF-Tools 9.5.367.0
PDF-XChange PRO 9.5.367.0
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain XPS/OXPS files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts.
  • kimiya working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain EMF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG2000 files or JPEG2000 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 9.5.367.0

Released at: 06 Mar 2023
Summary

Released version 9.5.367.0, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 9.5.366.0
PDF-Tools 9.5.366.0
PDF-XChange PRO 9.5.366.0
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG files or JPEG streams in PDF files.
  • hades_kito working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain XPS/OXPS files.
  • Andrea Micalizzi aka rgod working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain TIFF files.
  • hades_kito working with Trend Micro Zero Day Initiative
  • Andrea Micalizzi aka rgod working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts.
  • Andrea Micalizzi aka rgod working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
  • hades_kito working with Trend Micro Zero Day Initiative
2022

Security updates available in PDF-XChange Editor/Tools 9.5.366.0

Released at: 12 Dec 2022
Summary

Released version 9.5.366.0, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 9.5.365.0
PDF-Tools 9.5.365.0
PDF-XChange PRO 9.5.365.0
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain TIFF files.
  • Mat Powell of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 9.5.365.0

Released at: 28 Nov 2022
Summary

Released version 9.5.365.0, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 9.4.364.0
PDF-Tools 9.4.364.0
PDF-XChange PRO 9.4.364.0
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain EMF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG2000 files or JPEG2000 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain U3D files or U3D streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain TIFF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PNG files.
  • Mat Powell of Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 9.4.364.0

Released at: 27 Sep 2022
Summary

Release version 9.4.364.0, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 9.4.362.0
PDF-Tools 9.4.362.0
PDF-XChange PRO 9.4.362.0
Vulnerability details
Brief Acknowledgement
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain U3D files or U3D streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
  • Tran Van Khang (VinCSS)
  • Rocco Calvi (@TerR0C)
  • Anonymous working with Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain TIFF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain EMF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JBIG2 files or JBIG2 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG2000 files or JPEG2000 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PGM files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain XPS/OXPS files.
  • Tran Van Khang - khangkito (VinCSS) working with Trend Micro Zero Day Initiative

Security updates available in PDF-XChange Editor/Tools 9.4.362.0

Released at: 08 Aug 2022
Summary

Release version 9.4.362.0, which addresses potential security and stability issues.

Affected versions
Product Version
PDF-XChange Editor 9.3.361.0
PDF-Tools 9.3.361.0
PDF-XChange PRO 9.3.361.0
Vulnerability details
Brief Acknowledgement

Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JavaScripts
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain EMF/WMF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JBIG2 files or JBIG2 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PBM/PGM/PPM files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG files or JPEG streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain JPEG2000 files or JPEG2000 streams in PDF files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain ICO files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PNG files.
  • Mat Powell of Trend Micro Zero Day Initiative
Addressed potential issues where the application could be exposed to Use-after-Free, Out-of-Bounds Read, or Type Confusion vulnerability and crash, which could be exploited by attackers to execute remote code or disclose information. This occurs due to the access of null pointer/wild pointer or reference to the object that has been deleted without proper validation when handling certain PNG files.
  • Mat Powell of Trend Micro Zero Day Initiative

Get Support

Need more information? Get in touch.

You can contact us by phone, email or our social media accounts — we are here to assist you.

Contact Us