CVE-2024-8847

🗓️ 22 Nov 2024 21:05:41Reported by zdiType

PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process

Reporter	Title	Published	Views	Family All 9
BDU FSTEC	The vulnerability of PDF-XChange Editor’s PDF document viewing and editing software lies in the possibility of an operation going beyond the buffer in memory, allowing an attacker to execute arbitrary code.	4 Oct 202400:00	–	bdu_fstec
CNNVD	PDF-XChange Editor 安全漏洞	22 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-8847 PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability	22 Nov 202421:05	–	cvelist
EUVD	EUVD-2024-49575	3 Oct 202520:07	–	euvd
NVD	CVE-2024-8847	22 Nov 202421:15	–	nvd
Tenable Nessus	PDF-XChange Editor < 10.4.0.388 Multiple Vulnerabilities	20 Sep 202400:00	–	nessus
Positive Technologies	PT-2024-6611 · Unknown · Pdf-Xchange Editor	20 Aug 202400:00	–	ptsecurity
Vulnrichment	CVE-2024-8847 PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability	22 Nov 202421:05	–	vulnrichment
Zero Day Initiative	PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability	17 Sep 202400:00	–	zdi

NVD

Vulners

Vulnrichment

Node

pdf-xchange pdf-toolsMatch10.3.1.387

pdf-xchange pdf-xchange_editorMatch10.3.1.387

[
  {
    "vendor": "PDF-XChange",
    "product": "PDF-XChange Editor",
    "versions": [
      {
        "version": "10.3.1.387",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-24-1270/

17 Jun 2026 08:23Current

8High risk

Vulners AI Score8

CVSS 3.17.8

CVSS 37.8

EPSS0.00271

SSVC

CWE-125