CVE-2025-6661
BaseFortify
Publication date: 2025-06-25
Last updated on: 2025-07-01
Assigner: Zero Day Initiative
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pdf-xchange | pdf-tools | 10.5.2.395 |
| pdf-xchange | pdf-xchange_editor | 10.5.2.395 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free flaw in the PDF-XChange Editor's handling of App objects. It occurs because the software does not properly check if an object exists before operating on it. This flaw allows remote attackers to execute arbitrary code on the affected system if a user opens a malicious file or visits a malicious webpage.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to execute arbitrary code within the context of the current process, potentially leading to full compromise of the affected system. This could result in unauthorized access, data theft, or system damage.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid opening files or visiting pages from untrusted sources that could exploit the PDF-XChange Editor App Object Use-After-Free vulnerability. Ensure that users are aware of the risk and do not interact with suspicious content. Additionally, apply any available patches or updates from the software vendor once released.