Out-of-Bounds Read Vulnerability in Tungsten Automation Power PDF
CVE-2024-9750

7.8HIGH

Key Information:

Vendor

Tungsten Automation

Status
Power PDF
Vendor
CVE Published:
22 November 2024

What is CVE-2024-9750?

A vulnerability exists in the Tungsten Automation Power PDF product, linked to the parsing of PNG files. This flaw is characterized by a lack of adequate validation for user-supplied data, potentially allowing attackers to read data beyond allocated memory objects. This vulnerability necessitates user interaction, as exploitation requires the user to open a malicious file or access a harmful web page. Successful exploitation of this issue could enable attackers to execute arbitrary code within the context of the affected application, posing serious security risks to users.

Affected Version(s)

Power PDF 5.0.0.10.0.23307

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1348/
x_research-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.