CVE-2024-9732: Tungsten Automation Power PDF RCE Flaw

CVE-2024-9732 Overview

CVE-2024-9732 is a use-after-free vulnerability [CWE-416] in Tungsten Automation Power PDF. The flaw exists in the parser that processes XML Paper Specification (XPS) files. Power PDF fails to validate the existence of an object before performing operations on it, leading to memory corruption.

An attacker who convinces a user to open a crafted XPS file or visit a malicious page can execute arbitrary code in the context of the current process. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-24385 and disclosed as ZDI-24-1337.

Critical Impact
Successful exploitation results in arbitrary code execution with the privileges of the user running Power PDF, enabling document-based initial access.

Affected Products

Tungsten Automation Power PDF
Products embedding the vulnerable XPS parsing component
Legacy Kofax Power PDF installations that share the same code base

Discovery Timeline

2024-11-22 - CVE-2024-9732 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9732

Vulnerability Analysis

The vulnerability resides in the XPS file parsing logic of Tungsten Automation Power PDF. XPS is a page description format based on XML and ZIP packaging. When Power PDF opens or converts an XPS document, it constructs internal objects representing document elements. The parser then operates on those objects without verifying they still exist in memory.

When a referenced object has already been freed, the code dereferences a stale pointer. An attacker who controls the freed memory region can steer execution through a corrupted virtual function table or callback pointer. The result is arbitrary code execution inside the Power PDF process.

Exploitation requires local file handling with user interaction, consistent with document parser vulnerabilities. Delivery vectors include email attachments, drive-by downloads, and shared file locations.

Root Cause

The root cause is missing object lifetime validation in the XPS parser. Power PDF releases an object during parsing but retains a reference elsewhere in the processing pipeline. Subsequent code paths use that dangling reference, matching the classic use-after-free pattern captured by [CWE-416].

Attack Vector

The attack vector is local and requires user interaction. A target must open a malicious XPS file or visit a page that triggers Power PDF to parse attacker-controlled content. No authentication or elevated privileges are needed on the target system.

The vulnerability manifests during object dereference in the XPS parser. See the Zero Day Initiative Advisory ZDI-24-1337 for additional technical detail.

Detection Methods for CVE-2024-9732

Indicators of Compromise

Unexpected child processes spawned by PowerPDF.exe such as cmd.exe, powershell.exe, or rundll32.exe
XPS files (.xps, .oxps) delivered via email or downloaded from untrusted sources and opened by Power PDF
Power PDF process crashes with access violation exceptions in modules handling XPS parsing
Outbound network connections initiated from the Power PDF process shortly after opening a document

Detection Strategies

Monitor endpoint telemetry for Power PDF processes spawning shells, scripting engines, or LOLBins
Alert on Windows Error Reporting entries showing Power PDF crashes tied to XPS handling
Inspect email gateways and web proxies for XPS attachments and downloads targeting Power PDF users

Monitoring Recommendations

Enable process creation logging (Sysmon Event ID 1) and file open telemetry for XPS extensions
Correlate Power PDF process events with subsequent network connections and file writes to user-writable paths
Track document-based initial access patterns in the SIEM and map them to MITRE ATT&CK techniques T1204.002 and T1203

How to Mitigate CVE-2024-9732

Immediate Actions Required

Apply the security update from Tungsten Automation for Power PDF as referenced in ZDI-24-1337
Inventory endpoints running Power PDF and prioritize patching for users who routinely process external documents
Restrict opening of XPS files from untrusted sources at the email gateway and web proxy

Patch Information

Tungsten Automation has coordinated remediation through the Zero Day Initiative. Refer to the Zero Day Initiative Advisory ZDI-24-1337 and the vendor support portal for the fixed build and update instructions. Deploy the fixed version through standard software distribution channels.

Workarounds

Change the default handler for .xps and .oxps files away from Power PDF until patching is complete
Block inbound XPS attachments at the mail gateway and quarantine XPS downloads at the web proxy
Enforce least privilege so Power PDF runs without administrative rights, limiting the impact of successful exploitation
Educate users to avoid opening unsolicited XPS documents and to report suspicious files

bash

# Configuration example: block .xps attachments at an example mail transport rule
New-TransportRule -Name "Block XPS Attachments" \
  -AttachmentExtensionMatchesWords "xps","oxps" \
  -RejectMessageReasonText "XPS attachments are blocked pending CVE-2024-9732 remediation."