CVE-2024-9755 is an out-of-bounds read vulnerability classified under CWE-125 affecting Tungsten Automation Power PDF, specifically in the JP2 (JPEG 2000) file parsing component. The vulnerability stems from insufficient validation of user-supplied data during JP2 file processing, which allows an attacker to read memory beyond the bounds of allocated objects. This memory corruption can be leveraged to execute arbitrary code remotely in the context of the current process. Exploitation requires user interaction, such as opening a crafted JP2 file or visiting a malicious webpage that triggers the vulnerable parser. The vulnerability does not require any privileges or authentication, increasing its risk profile. The CVSS v3.0 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability, with low attack complexity but requiring user interaction. No patches are currently listed, and no known exploits have been observed in the wild, but the vulnerability was responsibly disclosed and tracked as ZDI-CAN-24472. This flaw poses a significant risk to environments using the affected Power PDF version 5.0.0.10.0.23307, especially where untrusted files or web content are handled.

The vulnerability enables remote code execution, allowing attackers to gain the same privileges as the user running Power PDF. This can lead to full system compromise, data theft, or disruption of services. Since the attack vector involves user interaction with malicious JP2 files or web content, organizations that frequently handle external PDF or image files are at heightened risk. The compromise of confidentiality, integrity, and availability can affect sensitive documents and workflows, potentially leading to intellectual property loss, regulatory non-compliance, and operational downtime. The lack of authentication requirement broadens the attack surface, making phishing or drive-by download attacks viable. Given the widespread use of PDF tools in corporate, government, and industrial sectors, the impact could be significant if exploited at scale.

Organizations should immediately restrict or monitor the handling of JP2 files within Power PDF until a patch is released. Employ file type filtering and sandboxing to isolate PDF processing. Educate users to avoid opening suspicious files or links from untrusted sources. Implement network-level protections such as web filtering and email gateway scanning to block malicious content delivery. Utilize endpoint detection and response (EDR) tools to detect anomalous behaviors indicative of exploitation attempts. Coordinate with Tungsten Automation for timely patch deployment once available. Consider disabling JP2 file support if feasible or using alternative PDF readers with no known vulnerabilities in JP2 parsing. Regularly update threat intelligence feeds to stay informed of emerging exploits related to this vulnerability.