ZDI-24-1142: Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability

Published Aug 13, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Dimension. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-20789.

Affected Software

1 affected component

Adobe Dimension

Event History

Aug 13, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-24-1142?

ZDI-24-1142 has been assigned a CVSS rating, indicating it is a serious vulnerability due to its potential for remote code execution.

How do I fix ZDI-24-1142?

To address ZDI-24-1142, update Adobe Dimension to the latest version provided by Adobe.

What type of attack does ZDI-24-1142 enable?

ZDI-24-1142 allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Dimension.

Is user interaction required for ZDI-24-1142 exploitation?

Yes, user interaction is required as the target must visit a malicious page or open a malicious file.

Which software is affected by ZDI-24-1142?

ZDI-24-1142 affects installations of Adobe Dimension.