CVE-2022-41149

CVE-2022-41149 is a critical remote code execution vulnerability affecting PDF-XChange Editor, stemming from a flaw in its U3D file parsing. An attacker can exploit this by crafting a malicious U3D file, which, when opened by a user, triggers a write past the end of an allocated buffer, allowing arbitrary code execution in the context of the current process. Rated 7.8 HIGH on CVSS, it requires user interaction (e.g., opening a malicious file) but has a low attack complexity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.