CVE-2022-37354

CVE-2022-37354 is a remote code execution vulnerability affecting PDF-XChange Editor, specifically within its J2K file parsing. An attacker can exploit this by crafting a malicious J2K file, which, when opened by a user, triggers a buffer overflow (write past the end of an allocated buffer). This allows for arbitrary code execution in the context of the current process. The vulnerability has a CVSS score of 7.8 (HIGH), indicating a significant risk. It requires user interaction (UI:R) and local access (AV:L), but has low attack complexity (AC:L), leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting it has not garnered widespread attention.