CVE-2024-9752

Summary

CVE-2024-9752 is an Information Disclosure vulnerability affecting Tungsten Automation Power PDF. The issue stems from improper validation of user-supplied JPG file data during parsing, leading to an Out-of-Bounds Read. This allows remote attackers to disclose sensitive information on affected installations. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. While this vulnerability does not directly result in code execution, it could be used in conjunction with other vulnerabilities to achieve that outcome. The ZDI (Zero Day Initiative) assigned the identifier ZDI-CAN-24469 to this issue prior to its public disclosure.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.