CVE-2024-27335: Kofax Power PDF RCE Vulnerability

CVE-2024-27335 Overview

CVE-2024-27335 is an out-of-bounds read vulnerability [CWE-125] in Kofax Power PDF (now Tungsten Automation Power PDF). The flaw exists in the application's PNG file parsing logic. Attackers can leverage the issue to execute arbitrary code in the context of the current process. Exploitation requires user interaction, such as opening a malicious PDF or visiting a page that delivers a crafted PNG payload. The Zero Day Initiative tracked the issue as ZDI-CAN-22018 and published advisory ZDI-24-217.

Critical Impact
A crafted PNG can trigger a read past an allocated object in Power PDF, enabling arbitrary code execution with the privileges of the user opening the file.

Affected Products

Tungsten Automation Power PDF (formerly Kofax Power PDF)
CPE: cpe:2.3:a:tungstenautomation:power_pdf:*:*:*:*:*:*:*:*
Component: tungstenautomation:power_pdf

Discovery Timeline

2024-04-03 - CVE-2024-27335 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27335

Vulnerability Analysis

The vulnerability resides in the PNG file parsing routines used by Power PDF when rendering embedded or attached image content. The parser fails to properly validate user-supplied data describing the PNG structure. Under specific conditions, the parser reads memory past the end of an allocated object. That out-of-bounds read can disclose adjacent process memory or corrupt program state used in later control-flow decisions.

An attacker who chains the disclosed data or corrupted state with additional primitives can achieve arbitrary code execution. Execution runs in the security context of the user account running Power PDF. On typical workstations, that account holds interactive-user privileges and access to user files.

Root Cause

The root cause is missing bounds validation on attacker-controlled fields inside a PNG stream. The parser trusts length or offset values from the file and dereferences memory beyond the object's boundary. This class of defect maps to CWE-125: Out-of-bounds Read.

Attack Vector

Exploitation is local and requires user interaction. The target must open a malicious document or visit a page that delivers a crafted PNG through Power PDF. No prior authentication to the host is required beyond the interactive user session. See the Zero Day Initiative Advisory ZDI-24-217 for the ZDI disclosure details.

No public proof-of-concept code is referenced in the advisory. A prose description of the exploitation path is provided above; no synthetic exploit is included here.

Detection Methods for CVE-2024-27335

Indicators of Compromise

PDF or standalone PNG files delivered by email or web download that contain malformed IHDR, IDAT, or ancillary chunks with inconsistent length fields.
Unexpected child processes spawned by Power PDF executables shortly after a document is opened.
Power PDF process crashes or exception events referencing image-decoding modules on hosts that render untrusted PDFs.

Detection Strategies

Inspect inbound PDF and PNG attachments at the mail and web gateway for structural anomalies in PNG chunk headers.
Correlate document-open events with subsequent process creation, network egress, or LOLBin execution from the Power PDF process tree.
Hunt for memory access violations logged by Windows Error Reporting that reference Power PDF image parsing modules.

Monitoring Recommendations

Enable process-creation and image-load telemetry on endpoints running Power PDF and forward the events to your SIEM.
Alert on Power PDF spawning shells, script interpreters, or rundll32.exe with unusual arguments.
Track file-write activity by Power PDF into autorun locations or user profile executable paths.

How to Mitigate CVE-2024-27335

Immediate Actions Required

Apply the vendor update for Tungsten Automation Power PDF as soon as a fixed build is available for your deployed version.
Restrict opening of PDFs from untrusted sources until patching is complete, and block PDF and PNG attachments from unknown senders at the gateway.
Run Power PDF as a standard user, not an administrator, to limit the impact of successful code execution.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-217 for coordinated disclosure details and to Tungsten Automation's product security page for the current fixed release. No specific patched version string is provided in the referenced NVD record.

Workarounds

Disassociate the .pdf file extension from Power PDF on endpoints that do not require it and route PDFs through a hardened alternative reader.
Deploy attachment sandboxing to detonate PDF and PNG files before delivery to end users.
Enforce Windows exploit protection settings such as ACG, CFG, and DEP on the Power PDF process to raise the cost of code execution.

bash

# Example: apply Windows Defender Exploit Guard mitigations to the Power PDF process
Set-ProcessMitigation -Name PowerPDF.exe -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy,TerminateOnError,ExtensionPoint,DynamicCode,BlockDynamicCode