CVE-2026-2040 PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Local attackers can escalate privileges and execute code by exploiting an uncontrolled search path element in the TrackerUpdate process.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-2040?
CVE-2026-2040 is a high-severity vulnerability in PDF-XChange Editor, published on 20 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of PDF-XChange Editor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the TrackerUpdate process. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of a target user. Was ZDI-CAN-27788.
Weakness: CWE-427
Which versions are affected by CVE-2026-2040?
How do I fix CVE-2026-2040?
No fix has been published for CVE-2026-2040 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2040 being exploited?
There is no known exploitation of CVE-2026-2040 in the wild and no public exploit code.
Sources
Also known as GHSA-9j8v-79v3-wcmp.