CVE-2025-6648

PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26671.

• CWE-125

• https://www.pdf-xchange.com/support/security-bulletins.htmlVendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-25-433/Third Party Advisory

Published

Jun 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66472XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2025-66473XWiki is an open-source wiki software platform. Versions 16.…7.5
• CVE-2025-66474XWiki Rendering is a generic rendering system that converts …8.8
• CVE-2025-66476Vim is an open source, command line text editor. Prior to ve…7.8
• CVE-2025-66478Rejected reason: This CVE is a duplicate of CVE-2025-55182.
• CVE-2025-66479Anthropic Sandbox Runtime is a lightweight sandboxing tool f…1.8
• CVE-2025-66480Wildfire IM is an instant messaging and real-time audio/vide…9.8
• CVE-2025-66481DeepChat is an open-source AI chat platform that supports cl…9.6
• CVE-2025-66482Misskey is an open source, federated social media platform. …6.5
• CVE-2025-66483IBM Aspera Shares 1.9.9 through 1.11.0 does not invalidate s…6.5
• CVE-2025-66484IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stor…5.4
• CVE-2025-66485IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTTP…5.4