CVE-2022-38403: Adobe InCopy SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Published Sep 16, 2022
·Updated
Adobe InCopy version 17.3 (and earlier) and 16.4.2 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
4 affected components
Adobe InCopy>=16.0<=16.4.2
Adobe InCopy>=17.0<=17.3
macOS
Microsoft Windows
Event History
Sep 16, 2022
CVE Published
via MITRE·05:14 PM
Data Sourced
via MITRE·05:14 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-38403?
The severity of CVE-2022-38403 is high with a CVSS score of 7.8.
2
Which versions of Adobe InCopy are affected by CVE-2022-38403?
Adobe InCopy versions 17.3 and earlier, as well as 16.4.2 and earlier, are affected by CVE-2022-38403.
3
How can CVE-2022-38403 be exploited?
Exploitation of CVE-2022-38403 requires user interaction, where a victim must open a malicious file.
4
Is Apple macOS vulnerable to CVE-2022-38403?
No, Apple macOS is not vulnerable to CVE-2022-38403.
5
Is Microsoft Windows vulnerable to CVE-2022-38403?
No, Microsoft Windows is not vulnerable to CVE-2022-38403.