CVE-2025-6640

PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26527.

• CWE-416

• https://www.pdf-xchange.com/support/security-bulletins.htmlVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-25-425/Third Party Advisory

Published

Jun 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66391In Citrix Cloud through 2025-11-10, an account with read-onl…8.8
• CVE-2025-66395ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2025-66396ChurchCRM is an open-source church management system. Prior …7.2
• CVE-2025-66397ChurchCRM is an open-source church management system. Prior …8.3
• CVE-2025-66398Signal K Server is a server application that runs on a centr…8.8
• CVE-2025-66399Cacti is an open source performance and fault management fra…8.8
• CVE-2025-66400mdast-util-to-hast is an mdast utility to transform to hast.…5.3
• CVE-2025-66401MCP Watch is a comprehensive security scanner for Model Cont…9.8
• CVE-2025-66402Misskey is an open source, federated social media platform. …6.5
• CVE-2025-66403FileRise is a self-hosted web-based file manager with multi-…5.4
• CVE-2025-66404MCP Server Kubernetes is an MCP Server that can connect to a…8.8
• CVE-2025-66405Portkey.ai Gateway is a blazing fast AI Gateway with integra…9.8