CVE-2024-12547 Overview
CVE-2024-12547 is an out-of-bounds write vulnerability in Tungsten Automation Power PDF. The flaw resides in the parser responsible for handling JPF files. Attackers can exploit the issue to execute arbitrary code in the context of the current process. Exploitation requires user interaction: the target must open a malicious file or visit a page hosting one. The Zero Day Initiative tracked this issue as ZDI-CAN-25560 and published advisory ZDI-24-1681. The vulnerability is classified under [CWE-787] and affects installations of Power PDF that process untrusted JPF content.
Critical Impact
Successful exploitation grants remote code execution with the privileges of the user running Power PDF, enabling full compromise of the document workflow.
Affected Products
- Tungsten Automation Power PDF
- Installations processing untrusted JPF files
- Environments where users open PDF attachments from external sources
Discovery Timeline
- 2025-02-11 - CVE-2024-12547 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12547
Vulnerability Analysis
The vulnerability exists in the JPF file parsing logic within Tungsten Automation Power PDF. JPF is a JPEG 2000 image format container that Power PDF processes when rendering embedded image streams inside PDF documents. The parser fails to properly validate user-supplied data before writing to an allocated memory buffer. This validation gap allows a crafted JPF stream to trigger a write past the end of the allocated object.
An out-of-bounds write of this kind corrupts adjacent memory structures. Attackers can shape the overflow to overwrite function pointers, virtual table entries, or heap metadata. Reliable exploitation yields code execution in the process context of the user opening the file. The issue is classified as [CWE-787] Out-of-bounds Write.
Root Cause
The parser lacks bounds checking on length or offset fields extracted from the JPF file. When these fields exceed the size of the destination buffer, the copy operation continues past the allocated region. No sanity check rejects malformed segment sizes before memory writes occur.
Attack Vector
An attacker delivers a malicious PDF or standalone JPF file to the target through email, web download, or shared storage. When the user opens the file in Power PDF, the parser processes the crafted stream and triggers the out-of-bounds write. The attack requires no authentication, but user interaction is mandatory. See the Zero Day Initiative Advisory ZDI-24-1681 for additional technical context.
Detection Methods for CVE-2024-12547
Indicators of Compromise
- Power PDF process crashes or abnormal termination when opening PDF or JPF files from untrusted sources
- Unexpected child processes spawned by Power PDF, such as command shells or scripting hosts
- PDF files containing malformed or oversized JPF image streams delivered via email or web downloads
- Outbound network connections from the Power PDF process shortly after document open events
Detection Strategies
- Monitor endpoint telemetry for anomalous process lineage where Power PDF spawns interpreters or LOLBins
- Inspect PDF attachments in mail gateways for embedded JPF or JPEG 2000 streams with malformed headers
- Alert on memory access violations logged by Windows Error Reporting for the Power PDF binary
Monitoring Recommendations
- Enable process creation logging and command-line auditing on endpoints running Power PDF
- Collect crash dumps from Power PDF for offline analysis to identify exploitation attempts
- Correlate document open events with subsequent file writes, registry modifications, and network activity
How to Mitigate CVE-2024-12547
Immediate Actions Required
- Inventory all systems running Tungsten Automation Power PDF and identify vulnerable versions
- Restrict opening of PDF and JPF files received from untrusted or external sources
- Apply the vendor-supplied patch referenced in ZDI-24-1681 once available for your version
Patch Information
Tungsten Automation coordinated with the Zero Day Initiative on this issue, tracked as ZDI-CAN-25560. Consult the Zero Day Initiative Advisory ZDI-24-1681 and Tungsten Automation product updates for the fixed release version. Apply the patched build to all endpoints running Power PDF.
Workarounds
- Configure mail and web gateways to strip or sandbox PDF attachments from untrusted senders
- Use an alternate PDF viewer for documents originating outside the organization until patches are deployed
- Enforce application allowlisting to block Power PDF from launching child processes such as cmd.exe or powershell.exe
- Train users to avoid opening unexpected PDF files, particularly those containing embedded images from unknown sources
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
