Vulnerability details

CVE-2026-2040

PDF-XChange Editor

PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

CVSS 3.0

7.3High

Official description

PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of PDF-XChange Editor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the TrackerUpdate process. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of a target user. Was ZDI-CAN-27788.

CVSS scores

Score	Version	Source	Vector
7.3High	3.0	CVEProject cvelistV5 (CNA) (zdi)	`CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
PDF-XChange	PDF-XChange Editor	10.7.2.400	CVEProject cvelistV5 (CNA)

References and advisories

https://www.zerodayinitiative.com/advisories/ZDI-26-122/ x_research-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-02-21
Last updated: 2026-02-24
State: Published
Assigner (CNA): zdi

Exploit prediction (EPSS)

0.29%

Probability of exploitation in 30 days

22.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-427
Uncontrolled Search Path Element