CVE-2024-9750 Overview
CVE-2024-9750 is an out-of-bounds read vulnerability in Tungsten Automation Power PDF. The flaw resides in the application's PNG file parsing logic and can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: the target must open a crafted PNG or visit a malicious page that delivers the file to Power PDF. The issue was disclosed through the Zero Day Initiative as ZDI-CAN-24466 and tracked in advisory ZDI-24-1348. The underlying weakness is classified as [CWE-125] Out-of-Bounds Read.
Critical Impact
A remote attacker can achieve code execution on affected Power PDF installations by convincing a user to open a malicious PNG file.
Affected Products
- Tungsten Automation Power PDF (see vendor advisory for exact fixed versions)
- Installations processing untrusted PNG files through Power PDF
- Endpoints where users open PDF or image attachments via Power PDF handlers
Discovery Timeline
- 2024-11-22 - CVE-2024-9750 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
- Additional details published in Zero Day Initiative Advisory ZDI-24-1348
Technical Details for CVE-2024-9750
Vulnerability Analysis
The vulnerability exists in the routine that parses PNG image data inside Power PDF. When the parser processes attacker-controlled fields, it reads beyond the bounds of an allocated object. This out-of-bounds read exposes adjacent memory contents and can be chained with other primitives to redirect execution flow. The attacker leverages the corrupted state to execute arbitrary code inside the Power PDF process, inheriting the privileges of the current user.
Because Power PDF is commonly registered as a handler for PDF and image files, delivery is straightforward through email attachments, drive-by downloads, or shared document repositories. Successful exploitation compromises confidentiality, integrity, and availability of the target host.
Root Cause
The root cause is insufficient validation of user-supplied data within PNG chunk parsing. The parser trusts length or offset fields embedded in the file without verifying them against the size of the underlying buffer. This allows read operations to cross the allocation boundary and reference memory the parser was not intended to access.
Attack Vector
Exploitation is local from a CVSS perspective but delivery is typically remote. An attacker crafts a malicious PNG, embeds or delivers it to the victim, and waits for the user to open the file in Power PDF. No authentication is required. User interaction is required, which limits mass exploitation but remains practical in phishing and watering-hole scenarios.
No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are described in the ZDI-24-1348 advisory.
Detection Methods for CVE-2024-9750
Indicators of Compromise
- Power PDF processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe shortly after opening a PNG or PDF file
- Crashes or abnormal terminations of Power PDF logged in Windows Event Viewer with faulting modules tied to image parsing
- PNG files with malformed chunk lengths or oversized ancillary chunks arriving via email or file shares
Detection Strategies
- Alert on Power PDF loading network-delivered PNG files followed by process injection or suspicious module loads
- Hunt for file writes from Power PDF into user-writable persistence locations such as %APPDATA% or Startup folders
- Inspect PNG samples with parsers that validate chunk boundaries to identify malformed structures indicative of exploitation attempts
Monitoring Recommendations
- Enable process command-line and image-load logging on endpoints running Power PDF
- Forward Power PDF crash telemetry and Windows Error Reporting events to a centralized SIEM for correlation
- Monitor email gateways and web proxies for PNG attachments delivered to users of Power PDF
How to Mitigate CVE-2024-9750
Immediate Actions Required
- Inventory endpoints running Tungsten Automation Power PDF and identify the installed version
- Apply the vendor-supplied update referenced in ZDI-24-1348 as soon as it is available in your environment
- Restrict opening of PNG and PDF files from untrusted sources until patches are deployed
- Educate users on the risks of opening unsolicited image or document attachments
Patch Information
Tungsten Automation has coordinated with the Zero Day Initiative on this issue. Refer to the Zero Day Initiative Advisory ZDI-24-1348 and the Tungsten Automation support portal for the fixed release. Update all Power PDF installations to the patched version identified in the vendor advisory.
Workarounds
- Change the default file handler for PNG and PDF files to a hardened viewer until patches are applied
- Use application allowlisting to prevent Power PDF from spawning scripting interpreters or shell processes
- Apply attack surface reduction rules that block child process creation from office and document applications
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
