CVE-2024-7352 is an out-of-bounds write in the way PDF-XChange Editor parses PDF files. It is rated High (CVSS 7.8). A user who opens a malicious file or visits a malicious page can trigger code execution. The Zero Day Initiative advisory says it is fixed in build 10.3.0.386.
What's affected
The record names PDF-XChange Editor as the affected product and gives no version range. The ZDI advisory (ZDI-24-1037) also does not list affected builds. It states only that the issue is "fixed in Build 10.3.0.386" and links to the vendor's version history. That means the safe reading is simple: anything older than 10.3.0.386 should be treated as exposed until the vendor's release notes say otherwise.
One source conflict is worth knowing about. The ZDI title and description call this a remote code execution issue, and say remote attackers can exploit it. The CVSS vector on the record is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which uses a local attack vector. The two views fit together once you read the detail: the attacker is remote, but the attack needs the victim to open a file or visit a page, so the scoring treats the vulnerable component as local. Both agree the severity is High, at 7.8.
ZDI reports it told the vendor on 13 March 2024, published the advisory on 31 July 2024, and updated it on 15 August 2024. The credit is listed as anonymous.
How to check if you're exposed
PDF-XChange Editor is a desktop application, so there is no package manager query that fits every install. On Windows, open the editor and use Help, then About, to read the build number. Compare it with 10.3.0.386. For a fleet, query installed software through your endpoint management tool and look for the product name and its version string.
Also check portable copies and installers cached on shared drives. These do not appear in software inventories and tend to stay old.
What to do now
- Update PDF-XChange Editor to build 10.3.0.386 or later, and confirm the number in the About dialog.
- Use the vendor's version history to pick the newest current build instead of stopping at the minimum.
- Until updated, avoid opening PDF files from unknown senders in the editor.
- Keep automatic updates on for the editor, and remove old installers from shared locations.
- Add the application to your software inventory so the next advisory is a lookup, not a hunt. The SCA dependency inventory demo shows the idea for libraries.
Why it matters
The weakness is CWE-787, an out-of-bounds write. ZDI describes the cause as missing validation of user-supplied data in PDF parsing, which lets a write land past the end of an allocated object. An attacker can use that to run code in the context of the current process, so the damage depends on the rights of the user who opened the file.
File parsers are a steady source of this class of bug because they take complex, attacker-shaped input. The usual defense is quick patching plus the habit of treating documents from outside the company as untrusted. The record does not set the KEV flag, and the sources I read do not report exploitation.
Quick check
Is a remote attacker able to hit this without any action from me?
No. The ZDI advisory says user interaction is required, because the target must open a malicious file or visit a malicious page.
Which version fixes it?
ZDI says build 10.3.0.386. Confirm in the vendor's version history before you roll it out.
Sources
Last reviewed: 19 October 2026.
