CVE-2025-6661: PDF-XChange Editor App Object RCE Flaw

CVE-2025-6661 Overview

CVE-2025-6661 is a use-after-free vulnerability [CWE-416] in PDF-XChange Editor that enables arbitrary code execution. The flaw exists in the handling of App objects, where the application fails to validate the existence of an object before performing operations on it. An attacker can leverage this freed-object reference to execute code in the context of the current process.

Exploitation requires user interaction. The target must open a crafted PDF file or visit a malicious page that delivers the document. The issue was reported through the Zero Day Initiative as ZDI-CAN-26823 and disclosed in advisory ZDI-25-446.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user running PDF-XChange Editor, enabling full compromise of the local user context.

Affected Products

PDF-XChange Editor 10.5.2.395
PDF-XChange PDF-Tools 10.5.2.395
Earlier builds sharing the same App object handling code path

Discovery Timeline

2025-06-25 - CVE-2025-6661 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6661

Vulnerability Analysis

The vulnerability resides in how PDF-XChange Editor handles JavaScript App objects embedded within PDF documents. The application operates on App object references without confirming that the underlying object still exists in memory. When a crafted document triggers premature destruction of the object, subsequent operations dereference a stale pointer.

An attacker can groom the heap so the freed memory is reoccupied by attacker-controlled data. The application then treats that data as a valid App object, allowing the adversary to redirect control flow. Because PDF-XChange Editor processes JavaScript automatically when documents are opened, no additional user action is required beyond opening the file.

The attack surface is local to the host, but delivery is straightforward through email attachments, drive-by downloads, or shared file repositories. Code executes in the security context of the logged-on user, providing a foothold for credential theft, persistence, or lateral movement.

Root Cause

The defect is a use-after-free condition in the App object lifecycle. The code path performs operations on the object without first verifying that the reference points to a live allocation. This missing existence check, combined with attacker-controlled JavaScript that can free objects mid-operation, produces the dangling pointer.

Attack Vector

Delivery relies on a malicious PDF file. The attacker crafts a document containing JavaScript that manipulates App object references, frees the underlying allocation, and triggers a subsequent operation that dereferences the stale pointer. Heap spraying or object-replacement techniques are typically used to place attacker-controlled data into the freed region prior to the dereference.

The vulnerability mechanism is documented in the Zero Day Initiative Advisory ZDI-25-446. No public proof-of-concept exploit code is currently available.

Detection Methods for CVE-2025-6661

Indicators of Compromise

PDF files containing JavaScript that references App objects with unusual allocation or destruction patterns
Unexpected child processes spawned by PDFXEdit.exe such as cmd.exe, powershell.exe, or rundll32.exe
Crashes or access violations in PDFXEdit.exe immediately after opening untrusted documents
Outbound network connections initiated by the PDF-XChange Editor process to non-vendor domains

Detection Strategies

Monitor process creation events where PDFXEdit.exe is the parent of scripting or LOLBin processes
Apply YARA rules targeting embedded JavaScript that manipulates App object handles in PDF streams
Inspect endpoint telemetry for heap corruption signatures and exception events within PDF-XChange modules
Correlate document open events with subsequent file system writes to user-writable persistence locations

Monitoring Recommendations

Enable command-line auditing and PowerShell script block logging on hosts running PDF-XChange Editor
Log and review PDF documents delivered through email gateways for embedded JavaScript content
Track installed versions of PDF-XChange Editor and PDF-Tools across the estate to identify unpatched hosts
Alert on memory access violations originating from PDF reader processes

How to Mitigate CVE-2025-6661

Immediate Actions Required

Update PDF-XChange Editor and PDF-Tools to the latest fixed release published by the vendor
Restrict opening of PDF files from untrusted sources until patching is complete
Disable JavaScript execution within PDF-XChange Editor through application preferences
Inventory endpoints running vulnerable build 10.5.2.395 and prioritize remediation

Patch Information

PDF-XChange has issued fixed builds. Refer to the PDF-XChange Security Bulletins for the specific patched version addressing CVE-2025-6661 and apply it across all affected installations.

Workarounds

Disable JavaScript in PDF-XChange Editor under Edit > Preferences > JavaScript until the patch is deployed
Block inbound PDF attachments at the mail gateway when sender reputation is low
Apply application allow-listing to prevent PDF reader processes from spawning shells or scripting hosts
Open untrusted PDFs only inside sandboxed or virtualized environments

bash

# Example: disable child process creation for PDF-XChange Editor via WDAC/AppLocker policy reference
# Block PDFXEdit.exe from launching common LOLBins
New-AppLockerPolicy -RuleType Path -User Everyone `
  -Path "%ProgramFiles%\Tracker Software\PDF Editor\PDFXEdit.exe" `
  -Action Deny -Conditions "ChildProcess:cmd.exe,powershell.exe,wscript.exe"