CVE-2023-37358

Kofax Power PDF U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-20469.

• CWE-125

• https://www.zerodayinitiative.com/advisories/ZDI-23-953/Third Party Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-23-953/Third Party Advisory

Published

May 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37352Kofax Power PDF JPG File Parsing Out-Of-Bounds Read Informat…5.5
• CVE-2023-37353Kofax Power PDF JPG File Parsing Out-Of-Bounds Read Informat…5.5
• CVE-2023-37354Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Remote C…7.8
• CVE-2023-37355Kofax Power PDF JPG File Parsing Use-After-Free Information …5.5
• CVE-2023-37356Kofax Power PDF GIF File Parsing Out-Of-Bounds Read Informat…5.5
• CVE-2023-37357Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Informat…5.5
• CVE-2023-37359Kofax Power PDF U3D File Parsing Out-Of-Bounds Read Informat…5.5
• CVE-2023-3736Inappropriate implementation in Custom Tabs in Google Chrome…4.3
• CVE-2023-37360pacparser_find_proxy in Pacparser before 1.4.2 allows JavaSc…6.1
• CVE-2023-37361REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection …2.7
• CVE-2023-37362Weintek Weincloud v0.13.6 could allow an attacker to abu…8.8
• CVE-2023-37364In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML prot…9.1