CVE-2024-3459 is a high severity flaw (CVSS 8.4) in KioWare for Windows, all versions through 8.34, that lets a person escape the locked down kiosk environment. The record lists no fixed version, so check with the vendor and tighten how kiosks are set up.
What's affected
The record lists KioWare for Windows, all versions through 8.34. The weakness is CWE-424 (improper protection of an alternate path), which means a path around the kiosk's restrictions was left open. The CVSS vector in the record says the attack is reached with local access, with low attack complexity, needing no privileges and no user interaction.
The description says a user can escape the environment by downloading PDF files, which by default open in an external PDF viewer. Built in functions of that viewer can then be used to launch a browser, search local files and start programs with the user's privileges.
The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
No fixed version is listed in the record. The CERT Polska page it links to returned a 404 error when I tried to read it, so I could not confirm any vendor fix or advice. Check the vendor site and CERT Polska directly.
How to check if you're exposed
KioWare is installed on kiosk and shared terminals, so the work is in your asset list. Find every Windows machine that runs KioWare and read the installed version in the program's own about or version screen, then compare with 8.34.
Then check what program opens PDFs on those machines, and whether users can download files at all. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Inventory every KioWare for Windows install and its version.
- Contact the vendor and ask for a fixed build or written guidance for your version, and watch CERT Polska for updates.
- Disable file downloads on kiosks, or point PDF handling at a viewer that cannot launch other programs.
- Run the kiosk under a standard user account with no access to sensitive folders.
- Add physical controls for public kiosks, such as locked cases and disabled unused ports.
Why it matters
A kiosk is useful because it limits a public user to one task. The weakness class here is an alternate path: the main door is locked, but another route, such as an external viewer or a gap in the logout timing, reaches the same resources. A locked down shell is only as strong as every program it can launch.
Good kiosk design starts from least privilege. Run the kiosk under a user account that cannot read sensitive files or start arbitrary programs, disable downloads where possible, and keep nothing else running beside it. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Quick check
Does this need network access?
The vector in the record says local access is needed. The risk is a person at the machine, which matters most for public and shared kiosks.
Sources
- NVD record data for CVE-2024-3459
- CERT Polska advisory linked from the record (returned a 404 when fetched for this post): https://cert.pl/en/posts/2024/04/CVE-2024-3459
- KioWare
Last reviewed: 19 October 2026.
