ZDI-24-1605: Adobe InDesign JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Adobe InDesign. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2024-49529.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-1605?
ZDI-24-1605 has been rated as a medium severity vulnerability due to its potential to disclose sensitive information.
How do I fix ZDI-24-1605?
To fix ZDI-24-1605, update Adobe InDesign to the latest version provided by Adobe after ensuring to apply all security patches.
What type of attacks does ZDI-24-1605 enable?
ZDI-24-1605 enables remote attackers to disclose sensitive information through user interaction with malicious pages or files.
Is user interaction required to exploit ZDI-24-1605?
Yes, user interaction is required to exploit ZDI-24-1605, as the target must visit a malicious page or open a malicious file.
Which software is affected by ZDI-24-1605?
Adobe InDesign is the affected software for vulnerability ZDI-24-1605.