Heap-based Buffer Overflow Remote Code Execution Vulnerability in Kofax Power PDF

CVE-2024-5301

Summary

A vulnerability exists in Kofax Power PDF that affects the parsing of PSD files, resulting in a heap-based buffer overflow. This flaw arises due to insufficient validation of user-supplied data lengths before copying them into a fixed-length heap-based buffer. When exploited, this vulnerability enables remote attackers to execute arbitrary code in the context of the affected process. Successful exploitation requires user interaction, where the target must visit a malicious webpage or open a crafted PSD file designed to exploit this weakness. Protecting against this vulnerability involves ensuring that users are educated about the risks of opening untrusted files and employing security measures to detect and block potential exploits.

References