CVE-2023-39491 is a High severity (CVSS 7.8) use after free flaw in PDF-XChange Editor, reached when a user opens a crafted TIF file or visits a malicious page. ZDI reports it fixed in PDF-XChange Editor 9.5.368 (V9) and 10.0.1 (V10). Update to those builds or newer, and treat files from unknown senders with caution until you do.
What's affected
PDF-XChange Editor and the PDF-Tools component are named in the record. The NVD entry lists tested builds in the 9.4, 9.5 and 10.0 series, and ZDI states the fix as PDF-XChange Editor V9 (9.5.368) and V10 (10.0.1).
The ZDI advisory does not give a list of affected version numbers, only the fixed ones. If you run any V9 build older than 9.5.368, or a V10 build older than 10.0.1, treat it as exposed until you have confirmed otherwise.
How to check if you're exposed
Open the editor and use Help, then About, to read the version number. On Windows you can also list installed copies from PowerShell:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like '*PDF-XChange*' |
Select-Object DisplayName, DisplayVersion
Compare each version with 9.5.368 for the V9 line and 10.0.1 for the V10 line. For a fleet, run the same query through your endpoint management tool and export the results.
What to do now
- Find every PDF-XChange Editor and PDF-Tools install, including per user installs and any copies baked into images.
- Update V9 installs to 9.5.368 or later and V10 installs to 10.0.1 or later, using the vendor's current download.
- Until updates land, avoid opening files from unknown senders in the editor, and consider opening them in a different viewer.
- If you manage the editor centrally, review whether its JavaScript support is needed, and follow the vendor's guidance on disabling features you do not use.
- Record the update in your asset inventory so the next advisory in this product line is a quick query.
Why it matters
This is a CWE-416 (use after free) issue. The parser does not check that an object exists before it operates on it while handling a TIF file. User interaction is required: the target must visit a malicious page or open a malicious file. The record says an attacker can use the flaw to execute code in the context of the current process.
Document viewers are a steady source of memory safety bugs because they parse many complex formats, often from untrusted senders. A flaw in the TIF handling is reachable by anything that can get a file in front of a user, such as an email attachment or a download link. The ZDI scores it 7.8 with local attack vector and required user interaction, which matches the NVD score of 7.8. Neither source marks it as exploited in the wild, and the CISA KEV flag in the record is false.
ZDI notes the issue was reported to the vendor and publicly released on 2023-08-17, with NVD publishing the record on 2024-05-03.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Quick check
Is CVE-2023-39491 exploited in the wild?
The record's KEV flag is false, and the ZDI advisory does not say it is being exploited. That can change, so check CISA KEV if this matters for your risk decisions.
Do I need to click anything for this to work?
Yes. The advisory says user interaction is required: the target must open a malicious file or visit a malicious page.
Sources
Last reviewed: 19 October 2026.
