CVE-2024-1681: 
Python vulnerability analysis and mitigation

A vulnerability was discovered in Tungsten Automation Power PDF that allows remote attackers to execute arbitrary code on affected installations. The vulnerability was assigned CVE-2024-12547 with a CVSS score of 7.8. The issue was reported on October 31, 2024, and publicly disclosed on December 11, 2024 (ZDI Advisory).

The vulnerability exists within the parsing of JPF files in Tungsten Automation Power PDF. The specific flaw results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. The vulnerability has been assigned a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (ZDI Advisory).

When successfully exploited, this vulnerability allows attackers to execute code in the context of the current process. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of the affected system (ZDI Advisory).

The vulnerability requires user interaction to be exploited, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges for exploitation (ZDI Advisory).

The vulnerability was reported to the vendor on October 31, 2024, and publicly disclosed on December 11, 2024. Users should refer to Tungsten Automation's documentation for specific mitigation instructions (ZDI Advisory).