CVE-2023-37331 is a high severity (CVSS 7.8) flaw in Kofax Power PDF for Windows, now published under the Tungsten Automation name in NVD. ZDI says it is fixed in Power PDF 5.0 Standard and Advanced version 5.0.0.10.0.23307. Update, and avoid opening files from untrusted sources until then.
What's affected
The NVD record lists Power PDF on Windows. The ZDI advisory ZDI-23-926 names Kofax as the vendor and says the issue is fixed in Power PDF 5.0 Standard and Advanced in version 5.0.0.10.0.23307, pointing to the vendor readme for that release. The record and the advisory agree on the score of 7.8. They do not give a list of earlier affected builds, so treat anything older than the fixed version as affected and check the vendor readme.
The flaw sits in how Power PDF parses GIF files. The issue results from lack of proper validation of the length of user-supplied data before it is copied into a fixed-length stack-based buffer. The record says an attacker can use it to run code in the context of the current process. The weakness is recorded as CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write).
How to check if you're exposed
- Open Power PDF and use the About dialog, normally under the Help menu, to read the full version number.
- Compare it with 5.0.0.10.0.23307. A lower build is in scope.
- On managed Windows fleets, read the installed version from your software inventory or from Programs and Features, and list every machine below the fixed build.
- Check whether a different edition or major version is installed. The advisory names Power PDF 5.0 Standard and Advanced, so confirm with the vendor if you run something else.
What to do now
- Install Power PDF 5.0.0.10.0.23307 or a later release from the vendor.
- Until every machine is updated, open PDF and image files from untrusted senders only in a sandbox or a different viewer.
- Remove local administrator rights from the people who use the reader, because the code would run with their rights.
- Add the product to your software inventory and set it to flag new advisories, so the next batch is caught earlier.
Why it matters
File format parsers are a classic home for memory safety bugs. Power PDF accepts many image formats and converts or embeds them, so each format decoder is its own code path with its own chances to get a length or a size wrong. In this case the code does not validate the data it reads before it writes into memory, so a crafted file can corrupt memory beyond what was allocated.
Because the code runs as the current user, the damage depends on who opens the file. A user with local administrator rights is a worse starting point than one on a standard account. This is one of eight Power PDF parsing and scripting issues published together, so patch for the batch, not for a single CVE.
The record does not mark this CVE as known exploited, and the ZDI advisory does not say it is exploited in the wild. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.
Quick check
Do I have to open a GIF file for this to matter?
The record says user interaction is required, in that the target must visit a malicious page or open a malicious file. Avoiding files from untrusted sources reduces exposure until you update.
Sources
Last reviewed: 19 October 2026.
