CVE-2024-12549: Tungsten Automation Power PDF RCE Vulnerability

CVE-2024-12549 is a remote code execution vulnerability in Tungsten Automation Power PDF caused by improper JP2 file parsing. Attackers can exploit this flaw to execute arbitrary code when users open malicious files. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-12549 Overview

CVE-2024-12549 is an out-of-bounds read vulnerability [CWE-125] in Tungsten Automation Power PDF. The flaw resides in the parser that processes JPEG 2000 (JP2) image files embedded in PDF documents. Attackers can trigger the issue by convincing a user to open a crafted file or visit a malicious page. Successful exploitation allows arbitrary code execution in the context of the current Power PDF process. The Zero Day Initiative tracked the research as ZDI-CAN-25565 and published advisory ZDI-24-1679.

Critical Impact
An attacker who delivers a crafted JP2-bearing PDF can execute code with the privileges of the user running Power PDF.

Affected Products

Tungsten Automation Power PDF
Products embedding the vulnerable Power PDF JP2 parser
Workstations processing untrusted PDF documents with Power PDF

Discovery Timeline

2025-02-11 - CVE-2024-12549 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12549

Vulnerability Analysis

The vulnerability sits inside the JP2 file parser used by Tungsten Automation Power PDF. Power PDF fails to properly validate user-supplied data when parsing a JPEG 2000 stream. The parser reads past the end of an allocated buffer during processing. This out-of-bounds read exposes adjacent memory contents and can corrupt program state used for subsequent operations. Attackers can shape the malformed JP2 stream to steer control flow and achieve arbitrary code execution in the current process. Exploitation requires user interaction, since the target must open a crafted file or visit a malicious page that delivers one.

Root Cause

The root cause is missing bounds validation on values consumed from the JP2 stream before they are used to index or read from an allocated object. The parser trusts length or offset fields from the file without confirming they fall within the allocated buffer. This is a classic [CWE-125] out-of-bounds read condition that can be escalated to code execution when the leaked or corrupted data influences function pointers, virtual tables, or other control data.

Attack Vector

The attack vector is local file processing with required user interaction. An attacker crafts a PDF containing a malformed JP2 image and delivers it through email attachments, drive-by download pages, shared file services, or messaging platforms. Once the victim opens the document in Power PDF, the parser processes the JP2 payload and triggers the out-of-bounds read. Code then executes with the privileges of the current user. See the Zero Day Initiative Advisory ZDI-24-1679 for additional technical context.

No verified public proof-of-concept code is available. Refer to the ZDI advisory for technical details.

Detection Methods for CVE-2024-12549

Indicators of Compromise

PDF files containing malformed JP2 (JPEG 2000) image streams with inconsistent length or offset fields
Unexpected crashes or exception logs generated by PowerPDF.exe when opening third-party PDFs
Child processes spawned by Power PDF that launch shells, scripting engines, or living-off-the-land binaries
Outbound network connections initiated from the Power PDF process shortly after a document is opened

Detection Strategies

Alert on Power PDF process crashes correlated with the opening of externally sourced PDF documents
Hunt for anomalous child processes of Power PDF such as cmd.exe, powershell.exe, rundll32.exe, or mshta.exe
Inspect email and web gateways for PDFs whose embedded JP2 objects fail structural validation

Monitoring Recommendations

Collect endpoint telemetry for process creation, module loads, and file writes performed by Power PDF
Monitor user download directories and email attachment paths for newly written PDFs opened by high-risk users
Track file reputation and hash telemetry for PDFs delivered from external senders and unmanaged web sources

How to Mitigate CVE-2024-12549

Immediate Actions Required

Inventory all endpoints running Tungsten Automation Power PDF and identify installed versions
Apply the vendor-supplied update referenced in ZDI-24-1679 as soon as it is available in your environment
Restrict opening of PDFs from untrusted sources on systems that cannot be patched immediately
Enforce least-privilege user accounts so a compromise of Power PDF does not yield administrative rights

Patch Information

Tungsten Automation coordinated remediation through the Zero Day Initiative. Refer to the Zero Day Initiative Advisory ZDI-24-1679 and Tungsten Automation product notices for the specific fixed build. Deploy the vendor-provided update to all systems running Power PDF and validate the version post-installation.

Workarounds

Configure the operating system to open PDFs from untrusted sources in a sandboxed viewer instead of Power PDF
Use email and web gateway policies to block or quarantine PDFs with malformed JP2 streams
Disable preview handlers that automatically render PDFs in file explorers and email clients
Educate users to avoid opening unsolicited PDF attachments and links until patching is complete

bash

# Query installed Power PDF versions on Windows endpoints
Get-CimInstance -ClassName Win32_Product | \
  Where-Object { $_.Name -like '*Power PDF*' } | \
  Select-Object Name, Version, Vendor, InstallDate