CVE-2023-40472 is a high severity (CVSS 7.8) untrusted pointer dereference in PDF-XChange Editor, in the handling of JavaScript strings. A malicious page or file can lead to code execution. The ZDI advisory says it is fixed in PDF-XChange Editor V9 (9.5.368) and V10 (10.0.1).
What's affected
The record names PDF-XChange Editor and PDF-Tools, build 9.5.368.0, and scores the flaw 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness is CWE-822 (untrusted pointer dereference).
Our sources disagree on versions. The record's product list names 9.5.368.0 as affected. The Zero Day Initiative advisory ZDI-23-1149 says the issue is fixed in V9 (9.5.368) and V10 (10.0.1). Treat 9.5.368 as the boundary build and confirm in the vendor's release history, which the advisory links, that your exact build number carries the fix.
ZDI reported the issue to the vendor on 2023-04-13 and published the advisory on 2023-08-17 (tracked as ZDI-CAN-20730). The record is not marked as a CISA Known Exploited Vulnerability and the advisory does not say it is exploited.
How to check if you're exposed
Open PDF-XChange Editor, choose Help, then About, and read the build number. On Windows you can also list it from the command line:
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like "*PDF-XChange*" |
Select-Object DisplayName, DisplayVersion
Compare the result with 9.5.368 for the V9 line and 10.0.1 for the V10 line. Endpoint management tools can run the same query across all machines.
What to do now
- Find every machine with PDF-XChange Editor or PDF-Tools installed.
- Update to the latest release of your major version, and at least 9.5.368 or 10.0.1 as the ZDI advisory states.
- Until then, do not open PDF files from sources you do not trust, and do not follow links from them.
- Check where the application is set as the default PDF handler, since that widens the exposure.
- Rescan your endpoint inventory afterwards and close the finding.
Why it matters
The advisory says the flaw is in the handling of JavaScript strings, and that a user supplied value is used as a pointer without proper validation. A pointer is a memory address. If an attacker controls it, the program can be made to read or write somewhere it should not, and from there to run code in the context of the current process.
The attack needs a person to open a malicious file or visit a malicious page, which is why the vector has user interaction set. That is a normal path for a PDF reader. It is also why a document editor that opens email attachments deserves the same update discipline as a browser.
Quick check
Can the flaw run code without anyone opening a file?
No. The record and the advisory both say user interaction is required: the target must visit a malicious page or open a malicious file.
Is this the same bug as CVE-2023-40471?
No. They were reported together but are separate. This one is in the handling of strings in the JavaScript engine (ZDI-23-1149). The other is in the handling of App objects (ZDI-23-1150). The advisories give the same fixed versions.
Sources
Last reviewed: 19 October 2026.
