CVE-2023-42078: PDF-XChange Editor has a out-of-bounds write weakness in the parsing of JP2 files, rated High at 7.8. The vendor's 5 September 2023 bulletin names 10.1.0.380 as the fix, and exploitation needs a user to open crafted content. A user has to open a malicious file for it to matter, so patch and be careful with attachments.
What's affected
The NVD record lists PDF-XChange Editor and PDF-Tools version 10.0.1.371. The vendor security bulletin groups this CVE under the 5 September 2023 entry, which names PDF-XChange Editor, PDF-Tools and PDF-XChange PRO at 10.0.1.371 as affected and 10.1.0.380 as the fixed release.
The CVSS 3.1 vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain terms: local attack vector, low complexity, no privileges, user interaction required, and high impact on confidentiality, integrity and availability. The weakness classes in the record are CWE-119 and CWE-787.
The Zero Day Initiative published the issue as ZDI-23-1381, with the same 7.8 score, and says the vendor has issued an update. That advisory does not list versions, so the bulletin is the version source.
One caution from the bulletin page: it does not state whether 10.1.0.380 includes fixes from the other bulletin entry. If you are on an older release, install the latest build rather than stopping at the first fixed number.
How to check if you're exposed
In the application, open Help and then About to see the version. On Windows you can read it for every machine with a short script:
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
"HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*PDF-XChange*" } |
Select-Object DisplayName, DisplayVersion
Anything at or below 10.0.1.371 is in scope. Any build older than 10.1.0.380 should be treated as affected until the vendor bulletin says otherwise. Check the bulletin for the exact range for your product edition.
What to do now
- Find every endpoint with PDF-XChange Editor, PDF-Tools or PDF-XChange PRO installed.
- Upgrade to 10.1.0.380 or later, ideally the current release.
- Read the vendor bulletin for CVE-2023-42078 to confirm the entry for your edition.
- Until patched, avoid opening PDF-XChange documents or images from untrusted senders, and keep email preview from opening attachments automatically.
- Add the application to your software inventory so the next advisory is a lookup, not a hunt.
Why it matters
An out-of-bounds write puts data past the end of an allocated buffer or object. That corrupts neighbouring memory, and memory corruption is the usual route from a malformed file to code execution. The advisory describes it as a write past the end of an allocated object. Here the affected code is the parsing of JP2 files, and the advisory says the cause is the lack of proper validation of user-supplied data, which can result in a memory corruption condition.
The advisory states that an attacker could execute code in the context of the current process. That means the attacker gets the same rights as the user running the editor. On a locked down desktop that limits the damage. On a machine where users hold local administrator rights, it does not.
User interaction is required, so this is a phishing and file sharing risk more than a network one. The record's KEV flag is false, and neither the NVD record nor the ZDI advisory we read says it is exploited in the wild.
Parser bugs in file formats come in batches. This CVE is one of many reported against the same product in the same period, which suggests a single fix will not close the gap if you stay on an old build. Desktop applications also do not appear in repository manifests, so use endpoint inventory for them. For the software you ship, the free dependency scan covers your libraries.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I have to open a file for this to matter?
Yes. The advisory says user interaction is required: the target must visit a malicious page or open a malicious file.
Is the fix the same for every PDF-XChange product?
The bulletin lists PDF-XChange Editor, PDF-Tools and PDF-XChange PRO together at the same fixed release. Confirm your edition in the bulletin before you roll out.
Sources
- PDF-XChange security bulletins (the older tracker-software.com link in the record redirects here)
- ZDI-23-1381 advisory (a sibling advisory, ZDI-23-1391, was fetched for scoring and vendor response)
- NVD record for CVE-2023-42078
Last reviewed: 19 October 2026.
