CVE-2025-6659: PDF-XChange Editor RCE Vulnerability

CVE-2025-6659 Overview

CVE-2025-6659 is an out-of-bounds write vulnerability [CWE-787] in PDF-XChange Editor's PRC file parser. The flaw allows attackers to execute arbitrary code in the context of the current user process. Exploitation requires user interaction, such as opening a malicious PRC file or visiting a page that serves one. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-26734 and disclosed in advisory ZDI-25-445. Affected versions include PDF-XChange Editor, PDF-XChange Pro, and PDF-Tools at version 10.5.2.395.

Critical Impact
Attackers can execute arbitrary code with the privileges of the user opening a crafted PRC file, enabling malware installation, data theft, or lateral movement.

Affected Products

PDF-XChange Editor 10.5.2.395
PDF-XChange Pro 10.5.2.395
PDF-XChange PDF-Tools 10.5.2.395

Discovery Timeline

2025-06-25 - CVE-2025-6659 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6659

Vulnerability Analysis

The vulnerability resides in the code that parses PRC (Product Representation Compact) files embedded within PDF documents. PRC is a 3D data format used by Adobe and compatible readers to render CAD-style 3D content inside PDFs. PDF-XChange Editor fails to properly validate user-supplied data during PRC stream parsing. This allows a crafted PRC payload to trigger a write past the end of an allocated buffer.

An attacker who successfully exploits the flaw achieves code execution in the context of the current process. Because PDF-XChange Editor typically runs with standard user privileges, the immediate impact is compromise of the user session and its accessible data. The issue is tracked as ZDI-CAN-26734 and disclosed publicly as ZDI-25-445.

Root Cause

The root cause is missing bounds validation on attacker-controlled fields inside PRC data structures. When the parser calculates a destination offset or copy length from unverified file input, it writes beyond the allocated heap or stack buffer. This corrupts adjacent memory, including function pointers, object vtables, or heap metadata that the attacker can leverage for control-flow hijack.

Attack Vector

Exploitation requires the victim to open a malicious PDF containing a crafted PRC stream, or to visit a web page that delivers such a file. The attack vector is local per the CVSS metrics, but delivery commonly occurs through phishing email attachments, drive-by downloads, or shared document workflows. No authentication is required, and no elevated privileges are needed on the target beyond running the vulnerable application.

No public proof-of-concept exploit code has been released for this issue. Technical details are described in the Zero Day Initiative Advisory ZDI-25-445.

Detection Methods for CVE-2025-6659

Indicators of Compromise

Unexpected child processes spawned by PDFXEdit.exe or PDFXTools.exe, particularly cmd.exe, powershell.exe, or script interpreters.
PDF files containing embedded PRC (/Subtype /PRC) streams arriving from untrusted senders or web downloads.
Crash dumps or Windows Error Reporting events referencing access violations in the PDF-XChange parsing modules.

Detection Strategies

Hunt for process-lineage anomalies where PDF-XChange binaries create shells, LOLBins, or network-capable utilities.
Inspect email gateway and proxy logs for PDF attachments containing 3D/PRC objects from external sources.
Correlate document opens with subsequent outbound connections to newly registered or low-reputation domains.

Monitoring Recommendations

Enable command-line and module-load auditing on endpoints that handle PDFs to capture exploitation artifacts.
Alert on writes to %APPDATA%, %TEMP%, or Startup directories by PDF-XChange processes.
Track version inventory of PDF-XChange installations to identify hosts still running 10.5.2.395 or earlier.

How to Mitigate CVE-2025-6659

Immediate Actions Required

Upgrade PDF-XChange Editor, PDF-XChange Pro, and PDF-Tools to the fixed release listed in the vendor security bulletin.
Block or quarantine inbound PDF attachments containing PRC/3D annotations at the email gateway pending patch deployment.
Instruct users to avoid opening PDFs from untrusted sources and to report suspicious documents.

Patch Information

PDF-XChange has published fixed builds addressing this issue. Refer to the PDF-XChange Security Bulletins page for the specific patched version and the Zero Day Initiative Advisory ZDI-25-445 for coordinated disclosure details. Deploy the vendor update to all affected hosts through your standard software distribution mechanism.

Workarounds

Disable 3D content rendering in PDF-XChange Editor preferences to reduce exposure to PRC parsing paths.
Enforce Protected Mode or open untrusted PDFs inside sandboxed environments such as Windows Sandbox or a browser-based viewer.
Apply application allowlisting to prevent PDF-XChange processes from launching interpreters or downloading executables.

bash

# Example: block PDF-XChange from spawning common LOLBins via WDAC/AppLocker rules
# (adjust to your policy management tooling)
New-AppLockerPolicy -RuleType Deny \
  -User Everyone \
  -Path 'C:\\Windows\\System32\\cmd.exe' \
  -ParentPath 'C:\\Program Files\\Tracker Software\\PDF Editor\\PDFXEdit.exe'