CVE-2022-37375 in PDF-XChange Editor
Summary
by MITRE • 03/29/2023
This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPC files. Crafted data in a JPC file can trigger a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-18069.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/19/2026
This vulnerability represents a critical buffer over-read flaw in PDF-XChange Editor that exposes systems to remote code execution risks through crafted JPC file manipulation. The issue stems from insufficient input validation during the parsing of JPC (JPEG 2000 Compressed) files, which are commonly used within PDF documents for image compression. When the application processes maliciously constructed JPC data, it fails to properly bounds-check memory accesses, leading to a read past the end of an allocated buffer. This memory corruption vulnerability falls under the CWE-125 weakness category, which specifically addresses out-of-bounds read conditions that can result in information disclosure and potential code execution. The vulnerability requires user interaction to exploit, meaning an attacker must convince a target to open a malicious file or visit a compromised webpage hosting the crafted JPC content. This attack vector aligns with common social engineering techniques used in targeted attacks and phishing campaigns. The technical impact of this flaw extends beyond simple information disclosure, as it creates a pathway for privilege escalation and arbitrary code execution within the context of the running PDF-XChange Editor process. This represents a significant security risk because the application typically runs with elevated privileges when processing PDF documents, providing attackers with potential access to sensitive system resources and data. The vulnerability's exploitation complexity is moderate, requiring a combination of precise JPC file construction and user interaction to achieve successful compromise. Organizations using PDF-XChange Editor are particularly at risk since this vulnerability can be leveraged to bypass traditional security controls and gain unauthorized access to corporate networks. The attack surface is broad due to the widespread use of PDF documents and image compression formats within enterprise environments. Security professionals should note this vulnerability's alignment with ATT&CK technique T1059.007 for command and scripting interpreter, as successful exploitation could enable attackers to execute malicious code with the privileges of the affected application. The ZDI-CAN-18069 identifier indicates this vulnerability was properly cataloged and addressed through coordinated disclosure channels. Organizations must implement immediate mitigations including application whitelisting, user education about suspicious file attachments, and network-based protections to prevent exploitation. The vulnerability demonstrates the critical importance of proper memory management and input validation in document processing applications, where buffer overflows can have severe consequences for system security and data integrity.