CVE-2024-9748: Tungsten Automation Power PDF RCE Flaw

CVE-2024-9748 Overview

CVE-2024-9748 is a use-after-free vulnerability in Tungsten Automation Power PDF that allows remote attackers to execute arbitrary code on affected installations. The flaw resides in the parsing of XPS (XML Paper Specification) files and stems from the lack of validation that an object exists before operations are performed on it [CWE-416].

Exploitation requires user interaction. A victim must open a malicious XPS file or visit a page that delivers one. Successful exploitation results in code execution in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-24464.

Critical Impact
Attackers who convince a user to open a crafted XPS file can execute arbitrary code with the privileges of the Power PDF process.

Affected Products

Tungsten Automation Power PDF
Products bundling the affected Power PDF XPS parser
Legacy Kofax Power PDF installations sharing the same codebase

Discovery Timeline

2024-11-22 - CVE-2024-9748 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9748

Vulnerability Analysis

The vulnerability is a use-after-free condition triggered during XPS file parsing in Tungsten Automation Power PDF. XPS is Microsoft's XML-based document format, and Power PDF supports importing and converting these documents.

During parsing, the application references an internal object without confirming that the object still exists. An attacker can shape the XPS document so that a required object is freed or never allocated, then force the parser to operate on the dangling reference. Manipulating the freed memory region lets the attacker control data that Power PDF later treats as a valid object, redirecting execution flow.

Code runs with the privileges of the user running Power PDF. On workstations where users hold local administrator rights, the impact extends to full host compromise.

Root Cause

The root cause is missing existence validation for an object prior to use, classified under [CWE-416] Use After Free. The XPS parser dereferences an object pointer whose lifetime is not correctly tracked against the parsing state machine.

Attack Vector

The attack vector is local and requires user interaction, per the CVSS metrics. Delivery typically occurs through phishing emails carrying a crafted XPS attachment, drive-by download links, or shared documents on collaboration platforms. Opening the file in Power PDF triggers the vulnerable parsing path.

No authentication is required, and no exploit code is publicly available at the time of publication.

For technical specifics on the parsing flaw, refer to the Zero Day Initiative Advisory ZDI-24-1339.

Detection Methods for CVE-2024-9748

Indicators of Compromise

Unexpected child processes spawned by Power PDF executables shortly after an XPS file is opened.
Crashes or exception events in Power PDF logs correlated with .xps file activity.
XPS files arriving from external senders with unusual embedded resource structures or oversized ZIP entries.
Outbound network connections from the Power PDF process to unfamiliar hosts following document open events.

Detection Strategies

Monitor process lineage for Power PDF spawning cmd.exe, powershell.exe, rundll32.exe, or other living-off-the-land binaries.
Alert on Power PDF loading unsigned or unusual DLLs from user-writable directories.
Inspect email gateways and web proxies for .xps attachments originating outside the organization.

Monitoring Recommendations

Enable command-line and module-load logging on endpoints running Power PDF and forward events to a centralized SIEM.
Baseline normal Power PDF behavior to make anomalous child-process creation and memory allocation patterns easier to identify.
Track file-open telemetry for XPS documents and correlate with subsequent process crashes or exploitation indicators.

How to Mitigate CVE-2024-9748

Immediate Actions Required

Apply the Tungsten Automation Power PDF update that addresses ZDI-24-1339 as soon as the vendor release is available in your environment.
Restrict opening of XPS files from untrusted sources through email filtering and web content controls.
Educate users to avoid opening unsolicited XPS attachments, since exploitation requires user interaction.

Patch Information

Tungsten Automation has coordinated disclosure through the Zero Day Initiative. Consult the Zero Day Initiative Advisory ZDI-24-1339 and the Tungsten Automation support portal for the fixed build number applicable to your Power PDF edition. Deploy the update to all workstations and terminal servers where Power PDF is installed.

Workarounds

Block or quarantine .xps attachments at the email gateway until patches are deployed.
Change the default handler for .xps files to a viewer not affected by this vulnerability.
Enforce least-privilege execution so Power PDF runs without local administrator rights, limiting the impact of successful exploitation.
Apply application allowlisting to prevent Power PDF from spawning script interpreters or downloading executables.

bash

# Example: block .xps attachments at an Exchange transport rule (PowerShell)
New-TransportRule -Name "Block XPS Attachments" \
  -AttachmentExtensionMatchesWords "xps" \
  -RejectMessageReasonText "XPS attachments are blocked pending CVE-2024-9748 remediation."