CVE-2025-0909

Summary

CVE-2025-0909 is a new Information Disclosure vulnerability affecting PDF-XChange Editor. This issue arises when the software fails to adequately validate user-supplied data during XPS file parsing, leading to an Out-of-Bounds Read situation. Remote attackers can exploit this flaw by convincing users to visit a malicious page or open a maliciously crafted file. Successful exploitation enables attackers to disclose sensitive information from the affected system. Although it does not directly result in code execution, this vulnerability (ZDI-CAN-25678) can be combined with other exploits to achieve more severe outcomes.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.