Anthony Fuller

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this issue. The specific flaw exists within the update functionality, resulting from the lack of proper validation of the certificate presented by the server. An attacker can leverage this issue to execute code in the context of the current user.

The issue allows multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that operates outside of the designated memory area, potentially leading to information disclosure, memory corruption, and remote code execution.

The issue allows multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file, causing the program to mishandle pointers. This can lead to remote code execution due to untrusted pointer dereference.

The issue allows an attacker to access configuration files due to the use of a hard-coded password for encrypting protected files in transit and at rest.

The issue allows for exploitation when a valid user opens a specially crafted, malicious input file. This can lead to referencing memory after it has been freed, which is a use-after-free condition. This condition can potentially be used for remote code execution or information disclosure.