CVE-2025-6645: PDF-XChange Editor U3D RCE Vulnerability

CVE-2025-6645 Overview

CVE-2025-6645 is a use-after-free vulnerability [CWE-416] in PDF-XChange Editor and PDF-XChange PDF-Tools. The flaw resides in the parser that processes Universal 3D (U3D) file content embedded within PDF documents. The parser performs operations on an object without first validating that the object still exists, leading to a use-after-free condition that attackers can leverage for arbitrary code execution.

Exploitation requires user interaction. A target must open a crafted PDF or visit a malicious page that delivers one. Code executes in the context of the current process running PDF-XChange Editor. The issue was reported through the Zero Day Initiative as ZDI-CAN-26642 and disclosed in advisory ZDI-25-430.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the user running PDF-XChange Editor, enabling attackers to install malware, steal data, or pivot deeper into the host.

Affected Products

PDF-XChange Editor 10.5.2.395
PDF-XChange PDF-Tools 10.5.2.395
Earlier versions processing U3D content through the same parser are likely affected

Discovery Timeline

2025-06-25 - CVE-2025-6645 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6645

Vulnerability Analysis

The vulnerability is a use-after-free condition in the U3D file parser used by PDF-XChange Editor. U3D is a binary 3D graphics format that PDF readers process when rendering embedded three-dimensional annotations inside a PDF. PDF-XChange Editor parses U3D streams to construct in-memory objects representing meshes, materials, and shaders.

The parser operates on an object reference without verifying that the underlying object is still valid. When the referenced object has already been freed, the parser dereferences a dangling pointer. This produces undefined behavior that an attacker can shape into a controlled write or call primitive.

The CVSS vector indicates that execution occurs in the user's local session, requires user interaction to open the malicious file, and impacts confidentiality, integrity, and availability. The EPSS probability of 0.247% reflects the requirement for victim interaction with a weaponized PDF.

Root Cause

The root cause is missing existence validation on a parser object prior to use. The code path frees or releases an object during U3D structure processing, then later operations reuse the original pointer. With heap grooming, an attacker can place attacker-controlled data at the freed allocation. The parser then reads a function pointer, vtable entry, or size field from attacker memory.

Attack Vector

The attack vector is a malicious U3D-embedded PDF delivered through email, web download, or shared file storage. The victim opens the PDF in PDF-XChange Editor or PDF-Tools. Parsing the embedded U3D object triggers the use-after-free, and the attacker-controlled allocation steers execution. Because U3D parsing occurs automatically when the document is rendered, no further user action beyond opening the file is required.

No public proof-of-concept code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are documented in the Zero Day Initiative Advisory ZDI-25-430.

Detection Methods for CVE-2025-6645

Indicators of Compromise

PDF documents containing embedded U3D streams from untrusted sources, especially those with unusually structured 3D objects
Unexpected child processes spawned by PDFXEdit.exe such as cmd.exe, powershell.exe, or rundll32.exe
Crashes or abnormal termination of PDF-XChange Editor when opening specific documents, recorded in Windows Application event logs
Outbound network connections initiated by PDF-XChange Editor immediately after document open

Detection Strategies

Hunt for process tree anomalies where PDFXEdit.exe is the parent of script interpreters or living-off-the-land binaries
Inspect PDF documents for embedded /3D annotations and U3D streams using static analysis tools such as pdfid and pdf-parser
Correlate document open events with subsequent file writes to %TEMP%, %APPDATA%, or autostart locations

Monitoring Recommendations

Enable command-line and process-creation logging on endpoints that run PDF-XChange Editor
Forward Sysmon events, EDR telemetry, and Windows Error Reporting crash data to a central SIEM for correlation
Alert on PDF-XChange Editor processes loading unexpected DLLs or establishing outbound connections to non-corporate IPs

How to Mitigate CVE-2025-6645

Immediate Actions Required

Update PDF-XChange Editor and PDF-Tools to the latest fixed build per the vendor security bulletin
Restrict opening of PDF documents from untrusted external sources until patching is complete
Apply application allow-listing to prevent PDF-XChange Editor from spawning script interpreters or shell binaries
Audit endpoints for installed versions of PDF-XChange Editor at or below 10.5.2.395

Patch Information

PDF-XChange has published fixes through its security bulletins page. Administrators should consult the PDF-XChange Security Bulletins to identify the version that addresses CVE-2025-6645 and deploy it across managed endpoints. Additional vulnerability detail is available in the Zero Day Initiative Advisory ZDI-25-430.

Workarounds

Disable 3D content rendering in PDF-XChange Editor preferences to prevent U3D parsing
Use Group Policy or file association controls to route untrusted PDFs to a sandboxed viewer
Block inbound PDFs at the mail gateway when they contain embedded /3D annotations and originate from external senders
Run PDF-XChange Editor under a standard user account with no local administrator rights to limit post-exploitation impact

bash

# Example: enumerate installed PDF-XChange Editor versions across Windows endpoints
Get-WmiObject -Class Win32_Product |
  Where-Object { $_.Name -like 'PDF-XChange*' } |
  Select-Object Name, Version, Vendor |
  Export-Csv -Path .\pdfxchange_inventory.csv -NoTypeInformation