CVE-2022-37366: PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. By performing actions in JavaScript, an attacker can trigger a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-37366?
CVE-2022-37366 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor.
How can an attacker exploit CVE-2022-37366?
To exploit CVE-2022-37366, the attacker needs the target to visit a malicious page or open a malicious file.
What software versions are affected by CVE-2022-37366?
PDF-XChange Editor version 9.3.361.0 is affected by CVE-2022-37366.
What is the severity of CVE-2022-37366?
CVE-2022-37366 has a severity rating of 7.8 (High).
How can I fix CVE-2022-37366?
To fix CVE-2022-37366, users should update to a patched version of PDF-XChange Editor provided by the vendor.