CVE-2024-9737: Power PDF Out-of-Bounds Write RCE Flaw

CVE-2024-9737 Overview

CVE-2024-9737 is an out-of-bounds write vulnerability in Tungsten Automation Power PDF. The flaw resides in the application's PDF file parsing logic. Attackers can exploit it to execute arbitrary code within the context of the current process. Exploitation requires the target to open a malicious PDF file or visit a malicious page that serves one. The Zero Day Initiative tracked this issue as ZDI-CAN-24453 before publication. The weakness is categorized as [CWE-787] Out-of-bounds Write.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the user running Power PDF, leading to full compromise of confidentiality, integrity, and availability of the affected host.

Affected Products

Tungsten Automation Power PDF
Products embedding the vulnerable PDF parsing component
Workstations processing untrusted PDF documents with Power PDF

Discovery Timeline

2024-11-22 - CVE-2024-9737 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9737

Vulnerability Analysis

The vulnerability exists within Tungsten Automation Power PDF's PDF file parsing routines. When the application processes a crafted PDF document, it fails to properly validate user-supplied data before writing to an allocated buffer. The resulting out-of-bounds write corrupts memory beyond the intended object boundary. Attackers can shape the corrupted memory to redirect execution flow and run arbitrary code in the context of the current user process.

The issue is classified under [CWE-787] Out-of-bounds Write. The EPSS probability is 0.313% at the 23.77 percentile, and no public proof-of-concept has been observed at the time of writing.

Root Cause

The root cause is missing bounds validation on attacker-controlled fields inside a PDF structure. The parser calculates or trusts a size value derived from the file, then writes data past the end of a heap-allocated object. This primitive gives an attacker control over adjacent memory, which is sufficient for reliable code execution when combined with heap grooming techniques.

Attack Vector

Exploitation is local and requires user interaction. A victim must open a malicious PDF file, either delivered by email, hosted on a website, or embedded in a document workflow. Once the file is parsed, the out-of-bounds write triggers and executes attacker-supplied code with the privileges of the Power PDF process. See the Zero Day Initiative Advisory ZDI-24-1350 for additional technical context.

Detection Methods for CVE-2024-9737

Indicators of Compromise

Power PDF processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe
Unexpected outbound network connections initiated by the Power PDF process shortly after opening a document
Crash dumps or Windows Error Reporting entries referencing Power PDF modules with access violation exceptions
PDF files containing malformed object streams or oversized length fields delivered via email or web downloads

Detection Strategies

Monitor process lineage for Power PDF executables spawning script interpreters or LOLBins
Alert on Power PDF module load events for unsigned or unexpected DLLs
Inspect PDF attachments through sandbox detonation and flag samples that trigger heap corruption signatures
Correlate user-opened PDF events with subsequent suspicious file writes to %APPDATA% or %TEMP%

Monitoring Recommendations

Enable command-line logging and PowerShell script block logging on endpoints running Power PDF
Forward endpoint telemetry to a centralized data lake for retrospective hunting against PDF-borne threats
Track version inventory of Power PDF installations to identify unpatched hosts

How to Mitigate CVE-2024-9737

Immediate Actions Required

Apply the vendor patch from Tungsten Automation to all Power PDF installations as soon as it is available
Restrict Power PDF from opening PDF files originating from untrusted email senders or unknown web sources
Enforce user awareness that PDF files can carry code execution payloads and should not be opened from unsolicited messages
Run Power PDF with least-privilege user accounts to reduce blast radius

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1350 for coordinated disclosure details and vendor remediation guidance. Administrators should consult Tungsten Automation directly for the fixed build number and download location.

Workarounds

Block inbound PDF attachments at the email gateway pending patch deployment
Configure application control policies to prevent Power PDF from launching child processes
Use an alternate PDF viewer with sandboxing enabled for untrusted documents until patched builds are deployed

bash

# Configuration example: block Power PDF from spawning script interpreters via WDAC or AppLocker
# Example AppLocker rule (pseudo): deny child process creation for PowerPDF.exe
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny \
  -Path "%PROGRAMFILES%\Tungsten\PowerPDF\PowerPDF.exe" \
  -Description "Restrict Power PDF child processes pending CVE-2024-9737 patch"