CVE-2025-0905: PDF-XChange Editor Information Disclosure

CVE-2025-0905 Overview

CVE-2025-0905 is an out-of-bounds read vulnerability in PDF-XChange Editor that arises during the parsing of JB2 image files embedded in PDF documents. The flaw allows remote attackers to disclose sensitive process memory on affected installations. Exploitation requires user interaction: the target must open a crafted PDF or visit a malicious page that delivers one. Attackers can chain this information disclosure with other vulnerabilities to achieve arbitrary code execution in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-25433 and tracked publicly as ZDI-25-067.

Critical Impact

A crafted JB2 stream inside a PDF can leak memory contents from the PDF-XChange Editor process and enable follow-on code execution when combined with other flaws.

Affected Products

• PDF-XChange Editor (versions prior to the vendor-released fix)
• PDF-XChange Editor Plus builds sharing the vulnerable JB2 parser
• Any product bundling the affected PDF-XChange Editor component

Discovery Timeline

• 2025-02-11 - CVE-2025-0905 published to the National Vulnerability Database
• 2025-02-12 - Last updated in NVD database

Technical Details for CVE-2025-0905

Vulnerability Analysis

The vulnerability resides in the JB2 (JBIG2) decoder used by PDF-XChange Editor to render compressed bi-level images embedded in PDF files. The parser fails to properly validate fields supplied by the JB2 stream before using them as indices or lengths against an allocated buffer. As a result, the decoder reads past the end of the allocated object and returns adjacent heap memory to attacker-controlled rendering paths.

Because the leaked bytes can be reflected into image data the attacker controls, an adversary can use this primitive to defeat memory layout randomization. Pairing the disclosure with a separate memory corruption bug lets the attacker pivot from information leak to arbitrary code execution inside the editor process. The weakness is categorized as [CWE-125] Out-of-Bounds Read.

Root Cause

The root cause is missing validation of user-supplied size or offset fields inside JB2 segment headers. The parser trusts attacker-controlled values when computing read positions, so a malformed segment causes the decoder to dereference memory beyond the intended object boundary.

Attack Vector

The attack vector is network-adjacent through file delivery. An attacker hosts a malicious PDF, emails it, or embeds it in a webpage that triggers the editor. When the victim opens the document, the JB2 decoder processes the crafted stream and reads out-of-bounds memory. No elevated privileges are required, but user interaction is mandatory.

No verified public proof-of-concept code is available. Refer to the Zero Day Initiative Advisory ZDI-25-067 for additional technical context.

Detection Methods for CVE-2025-0905

Indicators of Compromise

• PDF files containing malformed JB2/JBIG2 image streams with inconsistent segment header sizes
• Unexpected crashes or hangs of PDFXEdit.exe shortly after opening a document from email or web download
• PDF documents arriving from untrusted sources that reference JB2-encoded image XObjects with abnormally small allocations

Detection Strategies

• Inspect PDF objects for /Filter /JBIG2Decode entries paired with malformed or truncated segment data using static PDF analysis tools
• Monitor endpoints for PDF-XChange Editor processes spawning unexpected child processes or accessing sensitive memory regions
• Correlate document open events with subsequent abnormal network egress that could indicate exfiltration of leaked memory contents

Monitoring Recommendations

• Enable PDF reader process telemetry in EDR to capture file open events, module loads, and exception activity
• Track inbound email attachments and web downloads with .pdf extensions and route suspicious samples to a detonation sandbox
• Alert on PDF-XChange Editor crash dumps that reference the JB2 decoding modules and preserve dumps for triage

How to Mitigate CVE-2025-0905

Immediate Actions Required

• Update PDF-XChange Editor to the latest vendor-released version that addresses ZDI-25-067
• Restrict opening of PDF documents from untrusted sources until patching is complete
• Apply application allow-listing or attack surface reduction rules to limit PDF reader exposure to web-delivered files

Patch Information

PDF-XChange has issued an updated build of PDF-XChange Editor that corrects validation in the JB2 parser. Administrators should consult the ZDI-25-067 advisory and the vendor downloads page to obtain the fixed installer and deploy it across all managed endpoints.

Workarounds

• Configure email and web gateways to strip or sandbox PDF attachments from untrusted senders
• Set a non-vulnerable application as the default PDF handler until patching is verified
• Disable preview-pane rendering of PDF files in mail clients and file explorers to require explicit user action before parsing

# Configuration example: enforce updated PDF-XChange Editor build via Windows package manager
winget upgrade --id TrackerSoftware.PDFXChangeEditor --silent
# Verify installed version after upgrade
wmic datafile where name="C:\\Program Files\\Tracker Software\\PDF Editor\\PDFXEdit.exe" get Version