CVE-2024-9751 is an out-of-bounds read vulnerability classified under CWE-125 found in the JP2 (JPEG 2000) file parsing component of Tungsten Automation Power PDF version 5.0.0.10.0.23307. The vulnerability stems from insufficient validation of user-supplied data during JP2 file processing, which allows an attacker to read memory beyond the allocated buffer. This memory corruption can be leveraged to execute arbitrary code remotely within the context of the Power PDF process. Exploitation requires user interaction, such as opening a crafted JP2 file or visiting a malicious web page that triggers the vulnerable parser. The CVSS v3.0 base score is 7.8, indicating high severity, with attack vector local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:R). The impact includes full compromise of confidentiality, integrity, and availability of the affected system. Although no public exploits have been reported yet, the vulnerability was reserved and published by the Zero Day Initiative (ZDI) under ZDI-CAN-24468, signaling credible risk. The lack of a patch at the time of disclosure necessitates immediate mitigation efforts to reduce exposure.

If exploited, this vulnerability allows attackers to execute arbitrary code remotely on systems running the affected Power PDF version, potentially leading to full system compromise. This can result in unauthorized data access, data manipulation, or disruption of PDF processing workflows. Since Power PDF is used in many enterprise environments for document handling, exploitation could facilitate lateral movement, data exfiltration, or deployment of ransomware. The requirement for user interaction limits mass exploitation but targeted attacks against high-value individuals or organizations remain a significant risk. The vulnerability affects confidentiality, integrity, and availability, making it a critical concern for organizations relying on Power PDF for secure document management.

Until an official patch is released, organizations should implement the following mitigations: 1) Restrict or disable the opening of JP2 files within Power PDF or configure the application to prompt users with warnings before opening such files. 2) Employ application whitelisting and sandboxing techniques to limit the execution context of Power PDF and contain potential exploitation. 3) Educate users to avoid opening unsolicited or suspicious PDF files, especially those containing embedded JP2 images from untrusted sources. 4) Monitor network and endpoint logs for unusual Power PDF activity or crashes that could indicate exploitation attempts. 5) Use endpoint detection and response (EDR) solutions to detect anomalous behavior related to code execution within Power PDF processes. 6) Consider deploying network-level protections such as blocking access to known malicious URLs that could host exploit files. 7) Maintain regular backups and incident response plans to quickly recover from potential compromises. Once a patch becomes available, prioritize its deployment across all affected systems.