CVE-2022-37366

CVE-2022-37366 is a remote code execution vulnerability affecting PDF-XChange Editor, specifically within its handling of Doc objects. An attacker can exploit this by crafting a malicious file or web page that, when opened or visited by a user, triggers a read past the end of an allocated object via JavaScript actions. This allows for arbitrary code execution in the context of the current process. Rated 7.8 HIGH on the CVSS scale, this vulnerability requires user interaction (UI:R) and local access (AV:L) to be exploited. The potential impact is high across confidentiality, integrity, and availability (C:H, I:H, A:H). Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting low public awareness.