Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
CVE-2023-21597

7.8HIGH

Key Information:

Vendor

Adobe
Status
Incopy
Vendor
CVE Published:
13 January 2023

What is CVE-2023-21597?

Adobe InCopy prior to version 18.1 is susceptible to an out-of-bounds write vulnerability. This flaw can be exploited by opening a specially crafted file, leading to potential arbitrary code execution within the affected user's session. Proper user interaction is necessary for exploitation, making it essential for users to avoid opening untrusted documents.

Affected Version(s)

InCopy <= 18.0

InCopy <= 17.4

InCopy <= unspecified

References

https://helpx.adobe.com/security/products/incopy/apsb23-0...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.