ZDI-24-1332: Adobe Dimension SKP File Parsing Use-After-Free Remote Code Execution Vulnerability

Published Oct 8, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Dimension. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-45146.

Affected Software

1 affected component

Adobe Dimension

Event History

Oct 8, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-24-1332?

ZDI-24-1332 has been assigned a CVSS rating indicating significant risk due to its potential for remote code execution.

How do I fix ZDI-24-1332?

To mitigate the effects of ZDI-24-1332, ensure that your Adobe Dimension installation is updated to the latest version provided by Adobe.

What products are affected by ZDI-24-1332?

ZDI-24-1332 specifically affects installations of Adobe Dimension.

What type of attack does ZDI-24-1332 enable?

ZDI-24-1332 allows remote attackers to execute arbitrary code on a system after the user interacts with a malicious file or page.

Is user interaction required to exploit ZDI-24-1332?

Yes, ZDI-24-1332 requires user interaction for exploitation, such as visiting a malicious page or opening a harmful file.