Remote Code Execution Vulnerability in Kofax Power PDF XPS File Parsing
CVE-2023-51563

7.8HIGH

Key Information:

Vendor

Kofax
Status
Power PDF
Vendor
CVE Published:
3 May 2024

What is CVE-2023-51563?

A vulnerability in Kofax Power PDF arises from the improper validation of object existence during XPS file parsing. This flaw enables remote attackers to execute arbitrary code on the targeted systems when users interact with a malicious webpage or file. By exploiting this vulnerability, an attacker can operate within the context of the current process, raising serious security concerns for unpatched installations.

Affected Version(s)

Power PDF 5.0.0.19

References

https://www.zerodayinitiative.com/advisories/ZDI-24-001/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.