CVE-2024-9753

Summary

CVE-2024-9753 is a new information disclosure vulnerability affecting Tungsten Automation Power PDF. This issue permits remote attackers to expose sensitive data on affected systems by exploiting an out-of-bounds read vulnerability during PDF file parsing. The root cause stems from insufficient data validation, enabling an attacker to read beyond the allocated memory limit. While this vulnerability does not directly allow code execution, it could be combined with other weaknesses to achieve that goal. The ZDI research team identified this issue as ZDI-CAN-24470. User interaction, such as visiting a malicious webpage or opening a maliciously crafted PDF file, is required for an attacker to successfully exploit this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.