Remote Code Execution Vulnerability in Kofax Power PDF Due to JPF File Parsing

CVE-2024-30373

Summary

A significant security flaw exists in Kofax Power PDF related to the parsing of JPF files, enabling remote attackers to manipulate data that leads to an out-of-bounds write condition. This vulnerability arises from inadequate validation of user-supplied input, which may permit writes beyond the allocated boundaries of memory objects. Successful exploitation necessitates user interaction, specifically requiring the victim to view a malicious webpage or open a malformed file. Once the flaw is exploited, an attacker can execute arbitrary code with the permissions of the affected application, potentially compromising the integrity and confidentiality of the user's system.

References