CVE-2022-42396

CVE-2022-42396 is a remote code execution vulnerability affecting PDF-XChange Editor, specifically within its XPS file parsing functionality. An attacker can exploit this by crafting a malicious XPS file that, when opened by a user, allows arbitrary code execution due to improper validation of a user-supplied pointer value. The vulnerability carries a CVSS score of 7.8 (High), indicating a significant risk. It requires user interaction (UI:R) and local access (AV:L), but with low attack complexity (AC:L), leading to high confidentiality, integrity, and availability impacts (C:H, I:H, A:H). Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting low public awareness.