CVE-2025-27931

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Editor version 10.5.2.395. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
PDF-XChange Co. Ltd	PDF-XChange Editor	10.5.2.395

References

https://talosintelligence.com/vulnerability_reports/TALOS-2025-2171Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2171

Timeline

Published: Aug 5, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-279328.1Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file deletion process of the USB storage CVE-2025-279334.3Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allo CVE-2025-279347.5Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If CVE-2025-279358.6The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the auth CVE-2025-279365.9Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform co CVE-2025-279377.1Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If e CVE-2025-279385.3Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms").CVE-2025-279397.5An attacker can change registered email addresses of other users and take over arbitrary accounts.CVE-2025-27948.7An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-CVE-2025-279404.1Out-of-bounds read for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure. Software side ch CVE-2025-279536.5An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via CVE-2025-279546.5An issue in Clinical Collaboration Platform 12.2.1.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via