CVE-2024-9736: Tungsten Automation Power PDF RCE Vulnerability

CVE-2024-9736 Overview

CVE-2024-9736 is an out-of-bounds write vulnerability in Tungsten Automation Power PDF. The flaw resides in the application's PDF file parsing logic. Attackers can trigger memory corruption by crafting a malicious PDF document. Successful exploitation allows arbitrary code execution in the context of the current user process.

The vulnerability requires user interaction. A victim must open a malicious file or visit a page that delivers one. The issue was reported through the Zero Day Initiative as ZDI-CAN-24452 and tracked under ZDI-24-1351.

Critical Impact
Remote attackers can achieve arbitrary code execution on affected Power PDF installations when a user opens a crafted PDF, potentially compromising sensitive data and enabling lateral movement.

Affected Products

Tungsten Automation Power PDF
Products bundling the vulnerable Power PDF parsing component
Desktop endpoints processing untrusted PDF documents

Discovery Timeline

2024-11-22 - CVE-2024-9736 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9736

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] within the PDF parsing engine of Power PDF. Power PDF fails to properly validate user-supplied data embedded in PDF file structures. When the parser processes a crafted object, it writes past the end of an allocated buffer. This corrupts adjacent memory and enables control of process execution.

An attacker uses the write primitive to overwrite structures such as function pointers or vtable entries. From there, the attacker redirects execution to attacker-controlled code. Because the corruption occurs inside the Power PDF process, the attacker inherits the privileges of the user opening the document.

Exploitation requires local user interaction. The attack itself does not need authentication or elevated privileges on the target host.

Root Cause

The root cause is missing bounds validation on data read from PDF file streams. The parser trusts size or offset fields from the document without verifying them against the allocated destination buffer. This condition matches the classic out-of-bounds write pattern described in CWE-787.

Attack Vector

The attack vector is local and file-based. An attacker crafts a PDF containing malformed objects that trigger the out-of-bounds write during parsing. Delivery mechanisms include email attachments, drive-by downloads, shared network locations, and messaging platforms. Opening the file in Power PDF is sufficient to trigger the flaw.

No verified public proof-of-concept code is available. Technical details are documented in the Zero Day Initiative advisory ZDI-24-1351.

Detection Methods for CVE-2024-9736

Indicators of Compromise

Power PDF processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Unexpected outbound network connections initiated by the Power PDF process shortly after a document is opened.
Crash events or Windows Error Reporting entries referencing access violations inside Power PDF modules.
PDF files arriving from untrusted senders that contain malformed object streams or unusual embedded content.

Detection Strategies

Hunt for anomalous process lineage where Power PDF is the parent of shell, scripting, or LOLBin processes.
Correlate PDF file open events with subsequent file writes to user-writable directories such as %APPDATA% or %TEMP%.
Alert on Power PDF module crashes recurring across multiple endpoints, which can indicate exploitation attempts.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a central data lake for cross-host correlation.
Monitor email and web gateways for PDF attachments and prioritize samples with high structural anomaly scores.
Track patch and version state of Power PDF across the fleet to identify unpatched hosts exposed to malicious documents.

How to Mitigate CVE-2024-9736

Immediate Actions Required

Inventory all endpoints running Tungsten Automation Power PDF and identify unpatched installations.
Apply the vendor-supplied update as soon as it is available for your deployed Power PDF version.
Restrict opening of PDF files received from untrusted external sources until patching is complete.
Enable exploit mitigations such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) system-wide.

Patch Information

Refer to the Zero Day Initiative advisory ZDI-24-1351 and the Tungsten Automation support portal for the fixed Power PDF build. No dedicated vendor advisory URL is listed in the current NVD entry. Apply the vendor patch to all affected workstations and servers that process PDF documents.

Workarounds

Configure Windows to open PDF files with a hardened alternative reader until Power PDF is patched.
Block or quarantine inbound PDF attachments at the email gateway for high-risk user groups.
Enforce least-privilege user accounts so that successful exploitation does not yield administrative access.
Use application control policies to restrict Power PDF from spawning script interpreters and shells.

bash

# Configuration example: enumerate Power PDF installations across Windows endpoints
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like '*Power PDF*' } |
  Select-Object Name, Version, Vendor, InstallDate