CVE-2022-38440: Adobe Dimension SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
First published: Fri Oct 14 2022(Updated: )
Adobe Dimension versions 3.4.5 is affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Dimension | <3.4.6 | |
| macOS | ||
| Microsoft Windows Operating System |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2022-38440?
CVE-2022-38440 has been rated as high severity due to its potential for code execution via out-of-bounds read.
How do I fix CVE-2022-38440?
To fix CVE-2022-38440, upgrade Adobe Dimension to version 3.4.6 or later.
What version of Adobe Dimension is vulnerable to CVE-2022-38440?
Adobe Dimension versions prior to 3.4.6 are vulnerable to CVE-2022-38440.
What are the potential impacts of CVE-2022-38440?
CVE-2022-38440 could allow an attacker to execute arbitrary code in the context of the current user.
Is CVE-2022-38440 present in other operating systems besides Adobe Dimension?
CVE-2022-38440 specifically affects Adobe Dimension and does not affect the operating systems like macOS or Windows directly.
- agent/type
- agent/weakness
- agent/title
- agent/references
- agent/remedy
- agent/author
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe dimension
- vendor/apple
- canonical/macos
- vendor/microsoft
- canonical/microsoft windows operating system