Kofax Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

CVE-2024-5304

Summary

A vulnerability in Kofax Power PDF allows remote code execution due to improper handling of TGA file parsing. The flaw arises from a lack of validation for user-supplied data, enabling attackers to write beyond the allocated buffer. Exploitation requires user interaction, necessitating that the target either visits a malicious website or opens a specially crafted file. Successful exploitation can result in arbitrary code execution within the context of the current process, posing significant risks to user security.

References