CVE-2025-0904: PDF-XChange Editor Information Disclosure

CVE-2025-0904 Overview

CVE-2025-0904 is an out-of-bounds read vulnerability in PDF-XChange Editor that allows remote attackers to disclose sensitive information from affected installations. The flaw resides in the parser responsible for handling XPS (XML Paper Specification) files. Exploitation requires user interaction: the target must open a malicious XPS file or visit a malicious page that delivers one.

The vulnerability was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-25422 and published in advisory ZDI-25-071. Attackers can chain this read primitive with other vulnerabilities to achieve arbitrary code execution in the context of the current process.

Critical Impact

Successful exploitation leaks memory contents from the PDF-XChange Editor process and can be combined with adjacent flaws to execute attacker-controlled code on the victim host.

Affected Products

• PDF-XChange Editor (all versions prior to the vendor-released fix per ZDI-25-071)
• PDF-XChange product family components that share the XPS parsing library
• Windows endpoints where PDF-XChange Editor is the default handler for XPS files

Discovery Timeline

• 2025-02-11 - CVE-2025-0904 published to the National Vulnerability Database
• 2025-02-12 - NVD record last modified
• Reported through the Trend Micro Zero Day Initiative as ZDI-CAN-25422 and tracked publicly as advisory ZDI-25-071

Technical Details for CVE-2025-0904

Vulnerability Analysis

The issue is classified as an out-of-bounds read [CWE-125] within the XPS file parsing logic of PDF-XChange Editor. When the application processes a crafted XPS document, the parser fails to validate user-supplied size or offset fields before reading from an allocated buffer. The read extends past the end of the object, returning adjacent process memory to the attacker-controlled code path.

The vulnerability is network-reachable because XPS payloads can be delivered through web downloads, email attachments, or shared file stores. Exploitation requires the victim to open the malicious file, satisfying the user-interaction requirement. The disclosed memory can contain pointers, heap metadata, and other data useful for defeating address space layout randomization (ASLR) when chained with a write primitive.

Root Cause

The root cause is the absence of proper bounds validation on structured fields within XPS content streams. PDF-XChange Editor trusts length or index values embedded in the file and uses them directly to index into an allocated object. A crafted value drives the read pointer past the object boundary, exposing arbitrary process memory to subsequent parsing or rendering operations.

Attack Vector

An attacker hosts or delivers a malicious XPS file. When the victim opens the file in PDF-XChange Editor, the parser dereferences the malformed structure and returns out-of-bounds memory. The attacker uses the leaked data as a building block for a second-stage exploit, such as a heap corruption primitive, to reach arbitrary code execution in the user's security context.

No public proof-of-concept code is available for this vulnerability. Technical details are summarized in the Zero Day Initiative Advisory ZDI-25-071.

Detection Methods for CVE-2025-0904

Indicators of Compromise

• Unexpected XPS files (.xps, .oxps) arriving via email, web download, or removable media and being opened by PDFXEdit.exe.
• Crash dumps, Windows Error Reporting events, or access violations originating from PDF-XChange Editor when handling XPS content.
• PDF-XChange Editor processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe after opening a document.

Detection Strategies

• Inspect endpoint telemetry for PDFXEdit.exe file-open events that correlate with subsequent process crashes or anomalous memory reads.
• Apply YARA or content inspection at the mail and web gateway to flag XPS files with malformed structural fields or oversized length descriptors.
• Hunt for parent-child relationships where PDF-XChange Editor launches scripting or living-off-the-land binaries shortly after document open.

Monitoring Recommendations

• Enable Microsoft Defender Exploit Guard or equivalent Attack Surface Reduction rules that block child process creation from document readers.
• Forward Sysmon EventID 1 (process create), EventID 7 (image load), and EventID 11 (file create) for PDF-XChange Editor into your SIEM for correlation.
• Alert on access violations and module load failures within PDFXEdit.exe to surface attempted exploitation early.

How to Mitigate CVE-2025-0904

Immediate Actions Required

• Update PDF-XChange Editor to the fixed build referenced in advisory ZDI-25-071 as soon as it is available from the vendor.
• Block inbound XPS attachments at email and web gateways until patching is verified across the estate.
• Instruct users to avoid opening XPS files from untrusted sources, including links delivered in unsolicited messages.

Patch Information

PDF-XChange has acknowledged the issue through the Zero Day Initiative coordination process. Administrators should consult the vendor download portal for the latest PDF-XChange Editor build and validate the fix against the version range described in ZDI-25-071. No CISA KEV entry exists for this CVE at the time of writing, and no public exploit is currently available.

Workarounds

• Disassociate the .xps and .oxps file extensions from PDF-XChange Editor until patching completes, routing them to a sandboxed viewer instead.
• Run PDF-XChange Editor under a standard user account with Windows Defender Application Control or AppLocker policies that prevent unsigned child process execution.
• Use Group Policy or endpoint configuration tooling to deploy mark-of-the-web enforcement so that XPS files downloaded from the internet open in Protected View or are blocked outright.

# Example: remove XPS file association on Windows endpoints via PowerShell
Remove-Item -Path 'HKCU:\Software\Classes\.xps' -Recurse -ErrorAction SilentlyContinue
Remove-Item -Path 'HKCU:\Software\Classes\.oxps' -Recurse -ErrorAction SilentlyContinue

# Block PDF-XChange Editor from spawning script interpreters (AppLocker example)
New-AppLockerPolicy -RuleType Path -User Everyone `
  -PathCondition 'C:\Program Files\Tracker Software\PDF Editor\PDFXEdit.exe' `
  -Action Deny