ZDI-24-292: Adobe Premiere Pro AVI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Published Mar 13, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Premiere Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-20745.

Affected Software

1 affected component

Adobe Premiere Pro

Event History

Mar 13, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-24-292?

The severity of ZDI-24-292 is classified as high due to its potential to allow remote code execution.

How do I fix ZDI-24-292?

To fix ZDI-24-292, ensure that you update Adobe Premiere Pro to the latest version provided by Adobe.

What are the prerequisites for exploiting ZDI-24-292?

Exploitation of ZDI-24-292 requires user interaction, such as visiting a malicious webpage or opening a malicious file.

Which versions of Premiere Pro are affected by ZDI-24-292?

ZDI-24-292 affects Adobe Premiere Pro CS4 and potentially other versions that have not been updated.

What type of attacks can ZDI-24-292 enable?

ZDI-24-292 can enable remote attackers to execute arbitrary code on affected installations, posing significant risks.