CVE-2024-9735 Overview
CVE-2024-9735 is an out-of-bounds write vulnerability in Tungsten Automation Power PDF. The flaw resides in the parser that processes JPF files and stems from insufficient validation of user-supplied data. Attackers can trigger a write past the end of an allocated object during file parsing. Successful exploitation results in arbitrary code execution in the context of the current user process. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-24451 and disclosed publicly as ZDI-24-1365. Exploitation requires user interaction: the target must open a malicious JPF file or visit a page that delivers one.
Critical Impact
A user opening a crafted JPF file in Power PDF can grant an attacker arbitrary code execution with the privileges of the current user, enabling endpoint compromise and lateral movement.
Affected Products
- Tungsten Automation Power PDF
- Products embedding vulnerable Power PDF JPF parsing components
- Workstations that open JPF or JPEG 2000 content through Power PDF
Discovery Timeline
- 2024-11-22 - CVE-2024-9735 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-9735
Vulnerability Analysis
The defect is classified under [CWE-787] Out-of-Bounds Write. Power PDF parses JPF files, a container format associated with JPEG 2000, to render or extract embedded image data inside PDF documents. During parsing, the component fails to properly validate size or offset fields supplied by the file. A crafted structure causes the parser to write attacker-influenced bytes beyond the bounds of a heap-allocated object. Corrupting adjacent metadata, function pointers, or object vtables gives attackers control over program execution flow. Because parsing runs in the context of the user opening the document, code executes with that user's privileges. The exploit path is local and requires user interaction, but standard delivery methods such as email attachments or drive-by downloads satisfy that requirement.
Root Cause
The parser trusts length and offset values embedded in the JPF stream without enforcing bounds against the allocated destination buffer. This missing validation lets crafted input steer a memory copy or field write past the object boundary. See the Zero Day Initiative advisory ZDI-24-1365 for the vendor-coordinated technical summary.
Attack Vector
An attacker delivers a malicious JPF file, or a PDF containing one, to the target. Common delivery channels include phishing attachments, malicious download links, and compromised web pages. When the user opens the file in Power PDF, the vulnerable parser processes the crafted structure and triggers the out-of-bounds write. The attacker then pivots the memory corruption into arbitrary code execution within the Power PDF process.
No verified public proof-of-concept code is available for CVE-2024-9735. Refer to the ZDI advisory for coordinated technical details.
Detection Methods for CVE-2024-9735
Indicators of Compromise
- Unexpected child processes spawned by the Power PDF executable, particularly cmd.exe, powershell.exe, or scripting hosts.
- Crashes or Windows Error Reporting events referencing Power PDF modules during JPF or JPEG 2000 parsing.
- Inbound JPF files or PDFs with embedded JPEG 2000 streams arriving through email or web downloads.
- Outbound network connections initiated by Power PDF to previously unseen hosts shortly after a document is opened.
Detection Strategies
- Monitor for process-lineage anomalies in which Power PDF launches interpreters, shells, or LOLBins.
- Flag heap-corruption crash signatures and access violations originating from Power PDF image parsing modules.
- Inspect email and web gateways for JPF attachments and PDFs referencing JPEG 2000 codestreams from external senders.
Monitoring Recommendations
- Collect endpoint telemetry covering process creation, module loads, and file writes for Power PDF hosts.
- Correlate Power PDF crash events with subsequent process, file, and network activity within a short time window.
- Alert on Power PDF writing executables, DLLs, or scheduled task artifacts to user-writable directories.
How to Mitigate CVE-2024-9735
Immediate Actions Required
- Inventory all endpoints running Tungsten Automation Power PDF and identify versions predating the vendor fix.
- Apply the vendor-supplied Power PDF update that addresses the JPF parsing flaw referenced in ZDI-24-1365.
- Restrict receipt and opening of untrusted JPF files and PDFs containing JPEG 2000 streams pending patch deployment.
- Reinforce user awareness on opening PDF attachments from unverified senders.
Patch Information
Tungsten Automation has coordinated remediation through the Zero Day Initiative. Administrators should consult the vendor's Power PDF release notes and the ZDI-24-1365 advisory to identify the fixed build and deploy it across all managed workstations. No CISA KEV listing exists for CVE-2024-9735 at time of writing.
Workarounds
- Block or quarantine JPF files at email and web gateways until patching completes.
- Configure the default PDF handler on managed endpoints to a patched alternative if Power PDF cannot be updated immediately.
- Enforce least-privilege user accounts so that exploitation of a client-side parser does not yield administrative access.
- Enable exploit-mitigation features such as Windows Data Execution Prevention and Address Space Layout Randomization for the Power PDF process.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
