CVE-2022-42396: PDF-XChange Editor XPS File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-42396?
CVE-2022-42396 is rated as a high-severity vulnerability that allows remote code execution.
How do I fix CVE-2022-42396?
To fix CVE-2022-42396, users should update PDF-XChange Editor to the latest version that is beyond 9.5.366.0.
Who is affected by CVE-2022-42396?
CVE-2022-42396 affects all installations of PDF-XChange Editor versions prior to 9.5.366.0.
What kind of attack vector is used in CVE-2022-42396?
CVE-2022-42396 requires user interaction, as it involves visiting a malicious page or opening a malicious file.
What are the potential impacts of exploiting CVE-2022-42396?
Exploitation of CVE-2022-42396 may allow attackers to execute arbitrary code on the affected system.