ZDI-CAN-21698: ZDI-23-1666: Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Published Nov 15, 2023

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Media Encoder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2023-47040.

Affected Software

1 affected component

Adobe Media Encoder

Event History

Nov 15, 2023

Advisory Published

06:00 AM

Data Sourced

06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-21698?

The severity of ZDI-CAN-21698 is elevated due to its potential to allow remote code execution.

How do I fix ZDI-CAN-21698?

To fix ZDI-CAN-21698, users should update Adobe Media Encoder to the latest version available from Adobe.

Who is affected by ZDI-CAN-21698?

Users of Adobe Media Encoder 2022 are affected by ZDI-CAN-21698.

What is required to exploit ZDI-CAN-21698?

Exploitation of ZDI-CAN-21698 requires user interaction, such as visiting a malicious page or opening a malicious file.

What are the consequences of ZDI-CAN-21698?

The consequences of ZDI-CAN-21698 include potential remote code execution, allowing attackers to run arbitrary code on affected systems.