CVE-2023-42062: PDF-XChange Editor has a uninitialized variable weakness in the parsing of U3D files, rated High at 7.8. The vendor's 14 June 2023 bulletin names 10.0.0.370 as the fix, and exploitation needs a user to open crafted content. A user has to open a malicious file for it to matter, so patch and be careful with attachments.
What's affected
The NVD record lists PDF-XChange Editor and PDF-Tools version 9.5.368.0. The vendor security bulletin groups this CVE under the 14 June 2023 entry, which names PDF-XChange Editor, PDF-Tools and PDF-XChange PRO at 9.5.368.0 as affected and 10.0.0.370 as the fixed release.
The CVSS 3.1 vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms: local attack vector, low complexity, no privileges, user interaction required, and high impact on confidentiality, integrity and availability. The weakness classes in the record are CWE-457 and CWE-908.
The Zero Day Initiative published the issue as ZDI-23-1347, with the same 7.8 score, and says the vendor has issued an update. That advisory does not list versions, so the bulletin is the version source.
One caution from the bulletin page: it does not state whether 10.0.0.370 includes fixes from the other bulletin entry. If you are on an older release, install the latest build rather than stopping at the first fixed number.
How to check if you're exposed
In the application, open Help and then About to see the version. On Windows you can read it for every machine with a short script:
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*PDF-XChange*" } |
Select-Object DisplayName, DisplayVersion
Anything at or below 9.5.368.0 is in scope. Any build older than 10.0.0.370 should be treated as affected until the vendor bulletin says otherwise. Check the bulletin for the exact range for your product edition.
What to do now
- Find every endpoint with PDF-XChange Editor, PDF-Tools or PDF-XChange PRO installed.
- Upgrade to 10.0.0.370 or later, ideally the current release.
- Read the vendor bulletin for CVE-2023-42062 to confirm the entry for your edition.
- Until patched, avoid opening PDF-XChange documents or images from untrusted senders, and keep email preview from opening attachments automatically.
- Add the application to your software inventory so the next advisory is a lookup, not a hunt.
Why it matters
An uninitialized variable is memory that is used before the program has set it to a known value. What it contains depends on what was there before, which makes behavior unpredictable and, in a file parser, potentially influenced by the input. The advisory says memory is not properly initialized before it is accessed. Here the affected code is the parsing of U3D files, and the advisory says the cause is the lack of proper initialization of memory prior to accessing it.
The advisory states that an attacker could execute code in the context of the current process. That means the attacker gets the same rights as the user running the editor. On a locked down desktop that limits the damage. On a machine where users hold local administrator rights, it does not.
User interaction is required, so this is a phishing and file sharing risk more than a network one. The record's KEV flag is false, and neither the NVD record nor the ZDI advisory we read says it is exploited in the wild.
Parser bugs in file formats come in batches. This CVE is one of many reported against the same product in the same period, which suggests a single fix will not close the gap if you stay on an old build. Desktop applications also do not appear in repository manifests, so use endpoint inventory for them. For the software you ship, the free dependency scan covers your libraries.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I have to open a file for this to matter?
Yes. The advisory says user interaction is required: the target must visit a malicious page or open a malicious file.
Is the fix the same for every PDF-XChange product?
The bulletin lists PDF-XChange Editor, PDF-Tools and PDF-XChange PRO together at the same fixed release. Confirm your edition in the bulletin before you roll out.
Sources
- PDF-XChange security bulletins (the older tracker-software.com link in the record redirects here)
- ZDI-23-1347 advisory (a sibling advisory, ZDI-23-1391, was fetched for scoring and vendor response)
- NVD record for CVE-2023-42062
Last reviewed: 19 October 2026.
