LiveThreat Vulnerability Brief — CVE-2026-2040
What It Is — PDF‑XChange Editor’s TrackerUpdate component loads a library from an uncontrolled search path, allowing a local attacker who can run low‑privileged code to execute arbitrary code with higher privileges. Exploitability — No public exploit or PoC released; the flaw is locally exploitable with low‑complexity steps. CVSS 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
Affected Products — PDF‑XChange Editor (all versions prior to 10.7.3.401) from Tracker Software.
TPRM Impact — Enterprises that permit the editor on employee workstations, or vendors that embed it in SaaS or document‑processing pipelines, face a supply‑chain risk: a compromised endpoint can be escalated to admin rights, enabling credential theft, lateral movement, and potential exfiltration of sensitive third‑party data.
Recommended Actions —
- Upgrade all installations to version 10.7.3.401 or later immediately.
- Apply application‑whitelisting and restrict write permissions on the TrackerUpdate directory to prevent malicious DLL placement.
- Enforce least‑privilege policies for user accounts that run the editor; avoid running it as administrator.
- Deploy endpoint detection rules to alert on unexpected library loads from non‑trusted paths.
- Include the vendor’s patch‑release cadence in third‑party contracts and require timely remediation of similar vulnerabilities.
Source: Zero Day Initiative advisory