CVE-2024-9740

Summary

CVE-2024-9740 is a remote code execution vulnerability affecting Tungsten Automation Power PDF. The flaw resides in the BMP file parsing process, which fails to validate user-supplied data properly. This can result in an out-of-bounds write, enabling attackers to execute arbitrary code on affected systems. User interaction is necessary for exploitation, as the target must visit a malicious page or open a maliciously crafted file. This vulnerability, also known as ZDI-CAN-24456, poses a significant risk and requires immediate remediation to prevent potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.