Secunia Research has discovered a vulnerability in PDF-XChange Viewer, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error in PDFXCview.exe when parsing certain content and can be exploited to corrupt memory via a specially crafted PDF file.

Successful exploitation allows execution of arbitrary code when a user views a malicious PDF document.

NOTE: The vulnerable code is e.g. also present in the bundled PDF-XChange shell extension (XCShInfo.dll), which is installed by default. This vector allows exploitation as soon as a user e.g. selects a malicious PDF file or hovers the mouse pointer over it.

The vulnerability is confirmed in version 2.0.42.9. Other versions may also be affected.

Solution
Update to version 2.044.
Further details available in Customer Area

Provided and/or discovered by
Carsten Eiram, Secunia Research.

Changelog
Further details available in Customer Area

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2009-64/

Tracker Software Products:
http://www.docu-track.com/news/show/80

Deep Links
Links available in Customer Area