Remote Code Execution Flaw in Tungsten Automation Power PDF JP2 File Parser

CVE-2024-12551

What is CVE-2024-12551?

The Tungsten Automation Power PDF contains a vulnerability in its JP2 file parsing functionality, which allows remote attackers to execute arbitrary code. This flaw arises from inadequate validation of user-supplied JP2 file data, potentially leading to an out-of-bounds read scenario that can compromise system integrity. Exploitation of this vulnerability necessitates user interaction, as a target must visit a malicious webpage or open a compromised file. Attackers can exploit this to execute code within the context of the current process, posing a substantial risk to affected installations.

References