Remote Code Execution Vulnerability in Kofax Power PDF Due to OXPS File Parsing Stack-Based Buffer Overflow

CVE-2023-51566

Summary

A stack-based buffer overflow vulnerability exists in the OXPS file parsing feature of Kofax Power PDF. By failing to adequately validate the length of user-supplied data before copying it to a fixed-length stack-based buffer, the software allows remote attackers to exploit this flaw. Exploitation requires user interaction, as the target needs to open a malicious OXPS file or visit a web page that triggers the vulnerability. If successfully executed, the attacker can run arbitrary code within the context of the affected process, posing significant risks to system integrity and confidentiality. Users are advised to remain cautious about file sources and consider applying security updates to mitigate potential threats.

References