CVE-2025-6644: PDF-XChange Editor U3D RCE Vulnerability

CVE-2025-6644 Overview

CVE-2025-6644 is a use-after-free vulnerability [CWE-416] in PDF-XChange Editor and PDF-XChange PDF-Tools. The flaw resides in the parser that handles Universal 3D (U3D) file content embedded within PDF documents. The parser performs operations on an object without first validating that the object still exists. An attacker who convinces a user to open a crafted PDF or visit a malicious page can execute arbitrary code in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-26536 and tracked publicly as advisory ZDI-25-429.

Critical Impact
Successful exploitation grants arbitrary code execution under the rights of the user running PDF-XChange Editor, enabling local compromise from a single malicious document.

Affected Products

PDF-XChange Editor 10.5.2.395
PDF-XChange PDF-Tools 10.5.2.395
Earlier versions sharing the affected U3D parsing component

Discovery Timeline

2025-06-25 - CVE-2025-6644 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6644

Vulnerability Analysis

The vulnerability is a use-after-free condition triggered during the parsing of U3D streams embedded inside PDF files. PDF-XChange Editor supports 3D annotations using the U3D format, and the parser fails to verify that a referenced object still exists before invoking operations on it. When the parser dereferences a stale pointer to a freed object, the attacker controls the memory at that location and can redirect execution. Exploitation requires user interaction because the victim must open a crafted PDF or visit a page that delivers one to the application.

Root Cause

The root cause is missing object lifetime validation in the U3D parsing routine. The code accesses an object that has been freed earlier in the parsing flow without re-checking its existence. This pattern matches CWE-416 (Use After Free) and produces a dangling reference that an attacker can groom by shaping subsequent allocations within the same heap region.

Attack Vector

Attack delivery is local in scope but the file itself can arrive over any network channel. An attacker crafts a PDF containing a malformed U3D stream that triggers premature destruction of a parser-managed object. After grooming the heap with attacker-controlled data, the parser reuses the freed slot and operates on the attacker-controlled contents. The result is arbitrary code execution at the privilege level of the user running the editor.

No public proof-of-concept exploit was available at the time of publication, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are documented in the Zero Day Initiative Advisory ZDI-25-429.

Detection Methods for CVE-2025-6644

Indicators of Compromise

PDF files containing malformed or unusually structured U3D streams, especially when received from untrusted sources or email attachments
Unexpected child processes spawned by PDFXEdit.exe such as cmd.exe, powershell.exe, or rundll32.exe
Crashes or access violations in PDF-XChange Editor logs that reference the U3D parsing module

Detection Strategies

Inspect PDF objects for /Subtype /U3D annotations and validate their structure against the U3D specification at the email or web gateway
Monitor endpoint telemetry for process lineage anomalies originating from PDF-XChange Editor, including memory protection changes and shellcode-like behavior
Apply file reputation and sandbox detonation to PDFs containing 3D annotations before delivery to end users

Monitoring Recommendations

Alert on PDF-XChange Editor processes loading unexpected modules or performing network connections immediately after opening a document
Track Windows Error Reporting and crash dumps for repeated faults in PDF-XChange components, which can indicate exploitation attempts
Centralize endpoint and email logs in a SIEM or data lake to correlate suspicious PDF delivery with downstream execution events

How to Mitigate CVE-2025-6644

Immediate Actions Required

Upgrade PDF-XChange Editor and PDF-XChange PDF-Tools to a version later than 10.5.2.395 as listed in the vendor security bulletins
Restrict opening of PDF files from untrusted email senders, file shares, and external websites until patching is complete
Audit endpoint inventories to identify all installations of PDF-XChange Editor and PDF-Tools and prioritize user systems that handle externally sourced PDFs

Patch Information

PDF-XChange has published fixes through its security advisory channel. Review the PDF-XChange Security Bulletins for the specific fixed build addressing CVE-2025-6644, and consult the Zero Day Initiative Advisory ZDI-25-429 for technical context.

Workarounds

Disable 3D content rendering within PDF-XChange Editor preferences to prevent the U3D parser from processing untrusted streams
Configure application allowlisting to block PDF-XChange Editor from spawning shell or scripting interpreters
Enable Windows Defender Exploit Guard or equivalent exploit mitigations such as Control Flow Guard and Arbitrary Code Guard for PDFXEdit.exe

bash

# Example: block child process creation from PDF-XChange Editor using Windows Defender Application Control
# Review and adapt for your environment before deployment
New-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a `
                 -AttackSurfaceReductionRules_Actions Enabled