Full Report
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed three zero-day vulnerabilities in catdoc, as well as vulnerabilities in Parallel, NVIDIA and High-Logic FontCreator 15.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in catdoc, Parallels Desktop, NVIDIA cuobjdump, and High-Logic FontCreator
## CVE Details
| CVE ID | Vendor Advisory | CVSS Score | Severity | Weakness Type (CWE) |
| :--- | :--- | :--- | :--- | :--- |
| CVE-2024-48877 | TALOS-2024-2128 | N/A | N/A | Memory Corruption (Heap Buffer Overflow) |
| CVE-2024-52035 | TALOS-2024-2131 | N/A | N/A | Integer Overflow |
| CVE-2024-54028 | TALOS-2024-2132 | N/A | N/A | Integer Underflow |
| CVE-2025-31359 | TALOS-2025-2160 | N/A | N/A | Directory Traversal |
| CVE-2024-36486 | TALOS-2024-2126 | N/A | N/A | Arbitrary File Write (via Hard Link) |
| CVE-2024-54189 | TALOS-2024-2124 | N/A | N/A | Arbitrary File Write (via Hard Link) |
| CVE-2024-52561 | TALOS-2024-2123 | N/A | N/A | Symlink usage leading to Ownership Modification |
| CVE-2025-23247 | TALOS-2025-2151 | N/A | N/A | Integer Overflow leading to Out-of-bounds Write |
| CVE-2025-20001 | TALOS-2025-2157 | N/A | N/A | Out-of-bounds Read |
## Affected Systems
- **Products:** catdoc, Parallels Desktop for Mac, NVIDIA cuobjdump, High-Logic FontCreator
- **catdoc Versions:** 0.95
- **Parallels Versions:** 20.2.2 (55879), 20.1.1 (55740)
- **NVIDIA cuobjdump Versions:** 12.8.55
- **High-Logic FontCreator Versions:** 15.0.0.3015
- **Configurations:** All vulnerabilities require processing a specially crafted file provided by an attacker, except for Parallels vulnerabilities which exploit functionality related to unpacking archives or managing VM snapshots/deletion.
## Vulnerability Description
1. **catdoc (CVE-2024-48877, CVE-2024-52035, CVE-2024-54028):** Three vulnerabilities exist in `catdoc` 0.95, which processes text content from MS Office files. CVE-2024-48877 is a heap buffer overflow in the Shared String Table Record Parser for `xls2csv`. CVE-2024-52035 is an integer overflow in the OLE Document File Allocation Table Parser, and CVE-2024-54028 is an integer underflow in the OLE Document DIFAT Parser. Both integer issues can lead to generic heap-based memory corruption.
2. **Parallels Desktop (Multiple CVEs):** Several Privilege Escalation (LPE) flaws exist. CVE-2025-31359 is a Directory Traversal in PVMP package unpacking allowing arbitrary file writes. CVE-2024-36486 and CVE-2024-54189 involve hard link techniques where root services write files while an attacker controls the target path, enabling arbitrary file writes owned by root. CVE-2024-52561 exists during snapshot deletion where a symlink is abused to change ownership of root-owned files to a lower-privilege user.
3. **NVIDIA cuobjdump (CVE-2025-23247):** An integer overflow in the ELF Section Parsing functionality when processing CUDA fatbin files leads to an out-of-bounds write.
4. **High-Logic FontCreator (CVE-2025-20001):** An out-of-bounds read exists in version 15.0.0.3015 when processing a specially crafted font file.
## Exploitation
- **catdoc:** Status: Patches available (vendor unreachable, community fixes provided). Complexity: Likely Low (requires processing a malicious file). Attack Vector: Adjacent/Local (if processing remote files). Impact: Likely Remote Code Execution (RCE) due to memory corruption.
- **Parallels:** Status: Patched. Complexity: Medium (requires local user access or manipulation of VM files). Attack Vector: Local. Impact: Privilege Escalation.
- **NVIDIA cuobjdump:** Status: Patched. Complexity: Low. Attack Vector: Adjacent/Local. Impact: Likely RCE due to out-of-bounds write.
- **High-Logic FontCreator:** Status: Patched. Complexity: Low. Attack Vector: Local (User must open the malicious file). Impact: Information Disclosure.
## Impact
- **Memory Corruption (catdoc, NVIDIA):** High Confidentiality, High Integrity, High Availability impact (potential RCE).
- **Privilege Escalation (Parallels):** High Integrity impact (unauthorized privilege gain).
- **Information Disclosure (FontCreator):** High Confidentiality impact.
## Remediation
### Patches
- **catdoc:** Vendor was unreachable. Patches are available from the researcher's repository: `https://github.com/Cisco-Talos/catdoc-talos-fixes/releases/tag/talos-fixes.2025-05` (Debian expects to merge corrections).
- **Parallels:** Patches are available for versions 20.2.2 and 20.1.1 (specific versions fixing these issues should be confirmed via vendor advisory).
- **NVIDIA cuobjdump:** Patches available in CUDA Toolkit version subsequent to 12.8.55.
- **High-Logic FontCreator:** Patches available in version subsequent to 15.0.0.3015.
### Workarounds
- For catdoc, avoid processing untrusted/malformed Office files using the `catdoc` utilities until patched versions are deployed.
- Limit user permissions if running VM management tools if escalation is a major concern.
## Detection
- **catdoc:** Look for anomalous memory access patterns originating from `xls2csv` or other components parsing OLE files.
- **Parallels:** Monitor for unexpected file writes/ownership changes by root processes (`prl_vmarchiver` or snapshot deletion routines) targeting arbitrary locations or files owned by standard users.
- **NVIDIA cuobjdump:** Monitor file handlers parsing fatbin files for unusual buffer sizes or memory writes exceeding expected boundaries.
- **General:** Download the latest Snort rule sets from `snort.org` for coverage against known exploitation techniques.
## References
- Vendor advisories should be sought for specific Parallels, NVIDIA, and High-Logic fixed versions.
- Cisco Talos Advisories:
- `https://talosintelligence.com/vulnerability_reports/TALOS-2024-2128` (CVE-2024-48877)
- `https://talosintelligence.com/vulnerability_reports/TALOS-2024-2131` (CVE-2024-52035)
- `https://talosintelligence.com/vulnerability_reports/TALOS-2024-2132` (CVE-2024-54028)
- `https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160` (CVE-2025-31359)
- `https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126` (CVE-2024-36486)
- `https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124` (CVE-2024-54189)
- `https://talosintelligence.com/vulnerability_reports/TALOS-2024-2123` (CVE-2024-52561)
- `https://talosintelligence.com/vulnerability_reports/TALOS-2025-2151` (CVE-2025-23247)
- `https://talosintelligence.com/vulnerability_reports/TALOS-2025-2157` (CVE-2025-20001)
- catdoc fixes repository: `https://github.com/Cisco-Talos/catdoc-talos-fixes/releases/tag/talos-fixes.2025-05`