PDF-XChange vulnerabilities
Published CVEs affecting PDF-XChange products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-2040
High · 7.3
CWE-427 Feb 20, 2026
PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of PDF-XChange Editor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the TrackerUpdate process. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of a target user. Was ZDI-CAN-27788.
CVE-2025-64086
High · 7.5
CWE-476 Dec 9, 2025
NULL Pointer Dereference in PDF-XChange PDF-XChange Editor
A NULL pointer dereference vulnerability in the util.readFileIntoStream component of PDF-XChange Editor v10.7.3.401 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-64085
High · 7.5
CWE-476 Dec 9, 2025
NULL Pointer Dereference in PDF-XChange PDF-XChange Editor
A NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-58113
Medium · 6.5
CWE-125 Dec 2, 2025
Out-of-bounds Read in PDF-XChange PDF-XChange Editor
An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.7.3.401. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.