CVE-2023-37330 is a high severity (CVSS 7.8) flaw in Kofax Power PDF for Windows, now published under the Tungsten Automation name in NVD. ZDI says it is fixed in Power PDF 5.0 Standard and Advanced version 5.0.0.10.0.23307. Update, and avoid opening files from untrusted sources until then.
What's affected
The NVD record lists Power PDF on Windows. The ZDI advisory ZDI-23-925 names Kofax as the vendor and says the issue is fixed in Power PDF 5.0 Standard and Advanced in version 5.0.0.10.0.23307, pointing to the vendor readme for that release. The record and the advisory agree on the score of 7.8. They do not give a list of earlier affected builds, so treat anything older than the fixed version as affected and check the vendor readme.
The flaw is in the exportAsText method. The application exposes a JavaScript interface that lets a crafted document write arbitrary files, and the record says that can be used to run code as the current user. The weakness class is CWE-749 (exposed dangerous method or function).
How to check if you're exposed
- Open Power PDF and use the About dialog, normally under the Help menu, to read the full version number.
- Compare it with 5.0.0.10.0.23307. A lower build is in scope.
- On managed Windows fleets, read the installed version from your software inventory or from Programs and Features, and list every machine below the fixed build.
- Check whether a different edition or major version is installed. The advisory names Power PDF 5.0 Standard and Advanced, so confirm with the vendor if you run something else.
What to do now
- Install Power PDF 5.0.0.10.0.23307 or a later release from the vendor.
- Until every machine is updated, open PDF and image files from untrusted senders only in a sandbox or a different viewer.
- Remove local administrator rights from the people who use the reader, because the code would run with their rights.
- Add the product to your software inventory and set it to flag new advisories, so the next batch is caught earlier.
Why it matters
This is a design problem, not a memory bug. A PDF reader that runs document JavaScript has to decide which methods that script may call. When a method can write files to disk, a document turns into a way to place files on the machine, and from there code execution is a short step. That is why the weakness is classed as an exposed dangerous method rather than a parsing error.
The practical lesson is to treat document scripting as an attack surface. Disabling JavaScript in PDF readers, where your workflows allow it, removes a whole family of issues like this one.
The record does not mark this CVE as known exploited, and the ZDI advisory does not say it is exploited in the wild. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.
Quick check
Does the attacker need to be logged in?
No account is involved. The record says user interaction is required, because the target must visit a malicious page or open a malicious file.
Sources
Last reviewed: 19 October 2026.
