CVE-2018-6462: Tracker-Software PDF-Xchange Viewer

High severity, CVSS 7.8. EPSS: 2.5% chance of exploitation in the next 30 days.

Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.8 mishandle conversion from YCC to RGB colour spaces by calculating on the basis of 1 bpc instead of 8 bpc, which might allow remote attackers to execute arbitrary code via a crafted PDF document.

Affected products

• Tracker-Software PDF-Xchange Viewer: before 2.5.322.8 (fixed in 2.5.322.8)
• Tracker-Software Viewer Ax SDK: before 2.5.322.8 (fixed in 2.5.322.8)

Published 2018-01-31. Last modified 2026-06-17.