CVE-2024-9744: Power PDF JP2 File Parsing RCE Vulnerability

CVE-2024-9744 Overview

CVE-2024-9744 is an out-of-bounds write vulnerability [CWE-787] in Tungsten Automation Power PDF. The flaw resides in the parser that handles JPEG 2000 (JP2) image files embedded within PDF documents. Insufficient validation of user-supplied data lets attackers write past the end of an allocated buffer. An attacker can leverage this condition to execute arbitrary code in the context of the current process.

Exploitation requires user interaction. The target must open a malicious file or visit a page that delivers crafted JP2 content to Power PDF. The issue was reported through the Zero Day Initiative as ZDI-CAN-24460 and disclosed in advisory ZDI-24-1364.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user running Power PDF, enabling malware installation, data theft, or lateral movement.

Affected Products

Tungsten Automation Power PDF
Products bundling the vulnerable Power PDF JP2 parser
Workflows processing untrusted PDF documents containing JP2 image streams

Discovery Timeline

2024-11-22 - CVE-2024-9744 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9744

Vulnerability Analysis

The vulnerability exists in Power PDF's handling of JP2 image streams inside PDF documents. When Power PDF parses a crafted JP2 file, the code fails to validate the size or structure of attacker-controlled fields before writing decoded data into a fixed-size buffer. The write extends beyond the allocated region, corrupting adjacent memory.

Attackers can shape the overflow to overwrite object metadata, function pointers, or virtual table references. Combined with the predictable allocator behavior in the Power PDF process, the corruption can be steered toward controlled code execution. Because the flaw is triggered during rendering, no additional user action is required after the document opens.

The attack vector is local, but delivery is trivial through email attachments, cloud file shares, or drive-by download of PDF or JP2 files. Successful exploitation runs code with the privileges of the invoking user, which for desktop workflows typically includes access to sensitive documents, credentials cached by browsers, and internal network resources.

Root Cause

The root cause is missing bounds checking on user-supplied values used to size or offset writes during JP2 decoding. The parser trusts values embedded in the JP2 stream and performs the copy without confirming that the destination buffer can hold the resulting data. This maps to CWE-787: Out-of-bounds Write.

Attack Vector

An attacker crafts a malicious JP2 image, either standalone or embedded in a PDF, and delivers it to the victim. When the victim opens the file in Power PDF, the parser processes the malformed structure and triggers the out-of-bounds write. See the Zero Day Initiative Advisory ZDI-24-1364 for the vendor-coordinated disclosure details.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose based on the ZDI advisory; there is no exploit in the ExploitDB catalog and CISA has not listed the flaw as known-exploited.

Detection Methods for CVE-2024-9744

Indicators of Compromise

PDF or JP2 files with malformed JPEG 2000 code streams that fail standard structural validation
Unexpected child processes spawned by the Power PDF executable, such as cmd.exe, powershell.exe, or scripting hosts
Power PDF process crashes with access violation exceptions immediately after opening a document
Outbound network connections initiated by the Power PDF process to previously unseen hosts

Detection Strategies

Hunt for Power PDF processes writing executables or scripts to user-writable paths such as %TEMP%, %APPDATA%, or %LOCALAPPDATA%
Alert on parent-child relationships where Power PDF spawns interpreters or LOLBins
Inspect email and web gateway telemetry for PDF attachments containing JP2 streams from untrusted senders

Monitoring Recommendations

Enable behavioral endpoint identification for document-reader exploitation patterns and post-exploitation activity
Forward Power PDF process, file, and network telemetry to a centralized data lake for retrospective hunting
Track Windows Error Reporting entries citing Power PDF modules to surface crashes that may indicate exploitation attempts

How to Mitigate CVE-2024-9744

Immediate Actions Required

Apply the vendor-supplied Power PDF update referenced in ZDI-24-1364 as soon as it is available in your environment
Restrict opening of PDF files from untrusted sources until patching is complete
Enforce least-privilege user accounts so that a compromised Power PDF process cannot escalate to administrator

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1364 for coordinated disclosure information and vendor remediation guidance. Tungsten Automation customers should consult official Power PDF release notes for the fixed build. No vendor advisory URL is listed in the NVD record at time of writing.

Workarounds

Block inbound email attachments with .jp2 extensions and inspect PDF attachments for embedded JPEG 2000 streams
Configure application allowlisting to prevent Power PDF from launching child processes such as script interpreters
Set an alternate default PDF handler for high-risk users until the patch is validated and deployed

bash

# Configuration example: block Power PDF from spawning script interpreters via WDAC or AppLocker
# Example AppLocker rule (PowerShell) restricting child processes for the Power PDF executable
New-AppLockerPolicy -RuleType Path -User Everyone \
  -PathCondition "%PROGRAMFILES%\Tungsten\Power PDF\*" \
  -Action Deny -Description "Restrict Power PDF child process execution"