CVE-2022-38402: Adobe InCopy SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Published Sep 16, 2022
·Updated
Adobe InCopy version 17.3 (and earlier) and 16.4.2 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
4 affected components
Adobe InCopy>=16.0<=16.4.2
Adobe InCopy>=17.0<=17.3
macOS
Microsoft Windows
Event History
Sep 16, 2022
CVE Published
via MITRE·05:14 PM
Data Sourced
via MITRE·05:14 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for Adobe InCopy?
The vulnerability ID for Adobe InCopy is CVE-2022-38402.
2
What is the severity level of CVE-2022-38402?
The severity level of CVE-2022-38402 is high with a CVSS score of 7.8.
3
Which versions of Adobe InCopy are affected?
Adobe InCopy versions 17.3 and earlier, as well as 16.4.2 and earlier, are affected.
4
How can the vulnerability CVE-2022-38402 be exploited?
Exploitation of CVE-2022-38402 requires user interaction, where a victim must open a malicious file.
5
Is Apple macOS or Microsoft Windows affected by CVE-2022-38402?
No, Apple macOS and Microsoft Windows are not affected by CVE-2022-38402.